Description
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| github.com/cloudflare/golz4 | github.com/cloudflare/golz4 | < 0.0.0-20140711154735-199f5f787806 | 0.0.0-20140711154735-199f5f787806 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cloudflare/golz4 | < 0.0.0-20140711154735-199f5f787806 | 0.0.0-20140711154735-199f5f787806 | GHSA-4wp2-8rm2-jgmh |