CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-29482
High (7.5) in xz project xz. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/ulikunitz/xz 0.5.8.
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-835
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xz_project:xz
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-25xm-hr59-7c27 | Go | github.com/ulikunitz/xz | <0.5.8 | 0.5.8 |
| GO-2020-0016 | Go | github.com/ulikunitz/xz | <0.5.8 | 0.5.8 |
References
- https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b
- https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27
- https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b
- https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27