ulikunitz vulnerabilities

Products

• github.com/ulikunitz/xz 3

Latest ulikunitz CVEs

Newest publication first

1. CVE-2025-58058 github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

   Published 2025-08-28

   Medium·CVSS 5.3 EPSS 0.43%

   xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the...

2. CVE-2021-29482 denial of service in github.com/ulikunitz/xz

   Published 2021-04-28

   High·CVSS 7.5 EPSS 1.4%

   xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can...

3. CVE-2020-16845 Withdrawn Advisory: Infinite loop in xz

   Published 2020-08-06

   High·CVSS 7.5 EPSS 4.9%

   Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.