Skip to content
OpenAdvisories

Package · Go

github.com/ulikunitz/xz

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2025-58058

    github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

    xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory co…

    ulikunitz xz golang-github-ulikunitz-xz github.com/ulikunitz/xz Debian Ubuntu Go
  • High 7.5
    CVE-2021-29482

    denial of service in github.com/ulikunitz/xz

    xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a…

    ulikunitz xz github.com/ulikunitz/xz golang-github-ulikunitz-xz Debian Ubuntu Go