Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade criu-libsUpgrade buildahUpgrade skopeoUpgrade golang-srcUpgrade podmanUpgrade conmonUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade golang-miscUpgrade python3-podmanUpgrade golang-raceUpgrade buildah-testsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade containers-commonUpgrade toolboxUpgrade libslirpUpgrade criuUpgrade golang-testsUpgrade podman-catatonitUpgrade osbuild-composer-coreUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade skopeo-testsUpgrade golang-binUpgrade critUpgrade containernetworking-pluginsUpgrade osbuild-composer-workerUpgrade python3-criuUpgrade container-selinuxUpgrade podman-pluginsUpgrade udicaUpgrade osbuild-composer-dnf-jsonUpgrade runcUpgrade podman-testsUpgrade osbuild-composerUpgrade delveUpgrade go-toolsetUpgrade golang-docsUpgrade weldr-clientUpgrade podman-dockerUpgrade crunUpgrade podman-remoteUpgrade criu-devel | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade runcUpgrade containerd-stressUpgrade golang-testsUpgrade golang-docsUpgrade golangUpgrade golang-binUpgrade dockerUpgrade containerd-debuginfoUpgrade golang-raceUpgrade golang-sharedUpgrade golang-miscUpgrade runc-debuginfoUpgrade containerdUpgrade docker-debuginfoUpgrade golist-debuginfoUpgrade golistUpgrade golang-src | Dec 7, 2022 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golist-debugsourceUpgrade golang-binUpgrade golang-testsUpgrade golist-debuginfoUpgrade golang-sharedUpgrade golang-miscUpgrade golang-raceUpgrade golangUpgrade golang-srcUpgrade golist | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade slirp4netns-debugsourceUpgrade osbuild-ostreeUpgrade buildah-tests-debuginfoUpgrade crun-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-lvm2Upgrade python3-criuUpgrade libslirpUpgrade slirp4netns-debuginfoUpgrade python3-osbuildUpgrade podman-testsUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade osbuild-composer-debuginfoUpgrade podman-pluginsUpgrade criu-libsUpgrade libslirp-develUpgrade criu-develUpgrade skopeo-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade cockpit-composerUpgrade container-selinuxUpgrade criu-debugsourceUpgrade weldr-clientUpgrade weldr-client-tests-debuginfoUpgrade osbuild-luks2Upgrade cockpit-podmanUpgrade golang-srcUpgrade osbuild-selinuxUpgrade conmonUpgrade delveUpgrade runc-debuginfoUpgrade go-toolsetUpgrade skopeo-testsUpgrade slirp4netnsUpgrade osbuild-composer-dnf-jsonUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade containers-commonUpgrade osbuild-composer-workerUpgrade podman-gvproxyUpgrade weldr-client-debugsourceUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade delve-debuginfoUpgrade conmon-debuginfoUpgrade weldr-client-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmon-debugsourceUpgrade toolboxUpgrade podman-catatonitUpgrade golang-docsUpgrade criuUpgrade buildah-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade netavarkUpgrade osbuild-composer-worker-debuginfoUpgrade golangUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildahUpgrade toolbox-debugsourceUpgrade delve-debugsourceUpgrade udicaUpgrade libslirp-debuginfoUpgrade golang-raceUpgrade podmanUpgrade podman-remoteUpgrade podman-catatonit-debuginfoUpgrade golang-binUpgrade skopeo-debugsourceUpgrade osbuildUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-composer-debugsourceUpgrade toolbox-testsUpgrade podman-debuginfoUpgrade osbuild-composerUpgrade golang-miscUpgrade critUpgrade buildah-testsUpgrade skopeoUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade aardvark-dnsUpgrade golang-testsUpgrade python3-podmanUpgrade criu-libs-debuginfoUpgrade runcUpgrade buildah-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 9, 2023 | Oct 14, 2022 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade criu-develUpgrade golang-binUpgrade golang-docsUpgrade delveUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade golang-testsUpgrade podman-testsUpgrade libslirpUpgrade slirp4netnsUpgrade cockpit-composerUpgrade podman-dockerUpgrade udicaUpgrade golang-raceUpgrade runcUpgrade osbuild-composer-workerUpgrade python3-criuUpgrade crunUpgrade container-selinuxUpgrade podman-pluginsUpgrade weldr-clientUpgrade conmonUpgrade skopeoUpgrade osbuild-composer-dnf-jsonUpgrade critUpgrade osbuild-selinuxUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade buildahUpgrade podman-remoteUpgrade osbuild-lvm2Upgrade criu-libsUpgrade osbuild-composer-coreUpgrade libslirp-develUpgrade netavarkUpgrade podmanUpgrade aardvark-dnsUpgrade osbuild-luks2Upgrade python3-osbuildUpgrade golangUpgrade osbuild-ostreeUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade go-toolsetUpgrade golang-miscUpgrade osbuild-composerUpgrade golang-srcUpgrade osbuildUpgrade criu | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade buildahUpgrade openshift-clientsUpgrade skopeoUpgrade conmonUpgrade podman | Jan 26, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade oci-seccomp-bpf-hook-debuginfoUpgrade containers-commonUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade critUpgrade criu-libs-debuginfoUpgrade udicaUpgrade golang-binUpgrade osbuild-composer-workerUpgrade weldr-clientUpgrade podman-remoteUpgrade osbuild-composerUpgrade golang-testsUpgrade osbuild-ostreeUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade container-selinuxUpgrade aardvark-dnsUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade podman-plugins-debuginfoUpgrade osbuildUpgrade criu-debugsourceUpgrade python3-osbuildUpgrade runc-debugsourceUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade runc-debuginfoUpgrade osbuild-lvm2Upgrade go-toolsetNo solution existsUpgrade criu-develUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade buildahUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade weldr-client-debuginfoUpgrade golang-docsUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade skopeo-testsUpgrade crun-debugsourceUpgrade runcUpgrade osbuild-composer-worker-debuginfoUpgrade conmon-debuginfoUpgrade osbuild-luks2Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-podmanUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade netavarkUpgrade criu-libsUpgrade delve-debugsourceUpgrade podman-catatonit-debuginfoUpgrade slirp4netnsUpgrade cockpit-composerUpgrade osbuild-selinuxUpgrade golang-raceUpgrade cockpit-podmanUpgrade criuUpgrade podman-gvproxyUpgrade osbuild-composer-dnf-jsonUpgrade golang-srcUpgrade podman-testsUpgrade skopeoUpgrade toolboxUpgrade osbuild-composer-core-debuginfoUpgrade libslirpUpgrade osbuild-composer-coreUpgrade weldr-client-debugsourceUpgrade delve-debuginfoUpgrade conmonUpgrade osbuild-composer-debuginfoUpgrade golangUpgrade golang-miscUpgrade buildah-tests-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade osbuild-composer-debugsourceUpgrade podman-pluginsUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade crunUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade netavarkUpgrade toolboxUpgrade buildahUpgrade golang-raceUpgrade criu-debuginfoUpgrade runcUpgrade golang-binUpgrade toolbox-debugsourceUpgrade conmon-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade critUpgrade aardvark-dnsUpgrade buildah-testsUpgrade runc-debugsourceUpgrade delve-debugsourceUpgrade criuUpgrade libslirp-debuginfoUpgrade skopeoUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade skopeo-debugsourceUpgrade golangUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade libslirp-develUpgrade crunUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade slirp4netns-debugsourceUpgrade delve-debuginfoUpgrade containers-commonUpgrade criu-libsUpgrade runc-debuginfoUpgrade go-toolsetUpgrade delveUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-testsUpgrade python3-criu | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-raceUpgrade go1.18-openssl-raceUpgrade go1.18Upgrade go1.18-openssl-docUpgrade go1.19Upgrade go1.19-raceUpgrade go1.18-opensslUpgrade go1.19-docUpgrade go1.18-doc | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.16-goUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.18Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.13Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-go | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub