Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade podman-remoteUpgrade runcUpgrade crunUpgrade container-selinuxUpgrade osbuild-composer-workerUpgrade osbuild-composerUpgrade delveUpgrade skopeo-testsUpgrade weldr-clientUpgrade podman-testsUpgrade golang-binUpgrade containernetworking-pluginsUpgrade osbuild-composer-dnf-jsonUpgrade criu-develUpgrade golang-docsUpgrade go-toolsetUpgrade critUpgrade podman-dockerUpgrade udicaUpgrade podman-pluginsUpgrade containers-commonUpgrade golang-testsUpgrade toolboxUpgrade podmanUpgrade criuUpgrade libslirp-develUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podman-gvproxyUpgrade buildahUpgrade fuse-overlayfsUpgrade golang-raceUpgrade golang-srcUpgrade toolbox-testsUpgrade python3-podmanUpgrade criu-libsUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade golangUpgrade osbuild-composer-coreUpgrade podman-catatonitUpgrade slirp4netnsUpgrade golang-miscUpgrade libslirpUpgrade netavarkUpgrade buildah-tests | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade containerd-debuginfoUpgrade docker-debuginfoUpgrade golang-srcUpgrade golistUpgrade golang-sharedUpgrade containerdUpgrade golist-debuginfoUpgrade golang-miscUpgrade runc-debuginfoUpgrade golang-docsUpgrade dockerUpgrade golangUpgrade runcUpgrade golang-binUpgrade containerd-stressUpgrade golang-tests | Dec 7, 2022 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golistUpgrade golang-sharedUpgrade golang-miscUpgrade golang-raceUpgrade golist-debuginfoUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golist-debugsource | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade go-toolsetUpgrade podman-debugsourceUpgrade osbuild-ostreeUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade podman-testsUpgrade osbuild-composer-coreUpgrade slirp4netns-debugsourceUpgrade criu-libsUpgrade osbuild-composer-core-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-debuginfoUpgrade weldr-client-debuginfoUpgrade crunUpgrade criu-develUpgrade crun-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade conmon-debuginfoUpgrade python3-osbuildUpgrade osbuild-composer-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade container-selinuxUpgrade criu-debugsourceUpgrade weldr-client-tests-debuginfoUpgrade delve-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containers-commonUpgrade slirp4netnsUpgrade cockpit-composerUpgrade delveUpgrade runc-debuginfoUpgrade cockpit-podmanUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade weldr-client-debugsourceUpgrade crun-debugsourceUpgrade conmonUpgrade golang-srcUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-luks2Upgrade runc-debugsourceUpgrade osbuild-composer-workerUpgrade libslirpUpgrade osbuild-selinuxUpgrade skopeo-testsUpgrade toolbox-debuginfoUpgrade osbuild-lvm2Upgrade podman-plugins-debuginfoUpgrade weldr-clientUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade golang-testsUpgrade osbuildUpgrade golang-binUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criuUpgrade buildah-debugsourceUpgrade golang-docsUpgrade toolbox-debugsourceUpgrade delve-debugsourceUpgrade udicaUpgrade libslirp-debuginfoUpgrade golang-raceUpgrade netavarkUpgrade toolboxUpgrade podman-catatonitUpgrade osbuild-composer-worker-debuginfoUpgrade toolbox-testsUpgrade skopeoUpgrade podman-remoteUpgrade podman-debuginfoUpgrade osbuild-composer-debugsourceUpgrade osbuild-composerUpgrade golang-miscUpgrade critUpgrade buildah-testsUpgrade buildahUpgrade golangUpgrade containernetworking-plugins-debugsourceUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade criu-libs-debuginfoUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade podmanUpgrade osbuild-composer-tests-debuginfoUpgrade python3-podman | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 9, 2023 | Oct 14, 2022 |
| Oracle_linux | — | Upgrade delveUpgrade golang-testsUpgrade slirp4netnsUpgrade cockpit-composerUpgrade libslirpUpgrade podman-dockerUpgrade podman-gvproxyUpgrade udicaUpgrade golang-binUpgrade skopeo-testsUpgrade cockpit-podmanUpgrade golang-raceUpgrade runcUpgrade crunUpgrade criu-develUpgrade osbuild-composer-workerUpgrade container-selinuxUpgrade conmonUpgrade golang-docsUpgrade critUpgrade skopeoUpgrade podman-catatonitUpgrade osbuild-selinuxUpgrade python3-criuUpgrade weldr-clientUpgrade podman-pluginsUpgrade osbuild-composer-dnf-jsonUpgrade podman-testsUpgrade buildahUpgrade go-toolsetUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade criuUpgrade osbuildUpgrade osbuild-lvm2Upgrade python3-osbuildUpgrade golang-miscUpgrade criu-libsUpgrade osbuild-ostreeUpgrade osbuild-luks2Upgrade aardvark-dnsUpgrade podmanUpgrade netavarkUpgrade golang-srcUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade osbuild-composer-coreUpgrade osbuild-composerUpgrade libslirp-develUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade buildah-tests | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade podmanUpgrade conmonUpgrade skopeoUpgrade buildah | Jan 26, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade osbuild-luks2Upgrade critUpgrade podman-debuginfoUpgrade podmanUpgrade toolbox-testsNo solution existsUpgrade criu-develUpgrade osbuildUpgrade skopeo-testsUpgrade osbuild-ostreeUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade crun-debugsourceUpgrade go-toolsetUpgrade runc-debuginfoUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade golang-binUpgrade podman-remote-debuginfoUpgrade golang-testsUpgrade podman-gvproxy-debuginfoUpgrade conmon-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composerUpgrade containers-commonUpgrade delveUpgrade criu-debugsourceUpgrade aardvark-dnsUpgrade weldr-client-debuginfoUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade osbuild-lvm2Upgrade udicaUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade golang-docsUpgrade libslirp-debugsourceUpgrade buildahUpgrade buildah-testsUpgrade containernetworking-plugins-debuginfoUpgrade weldr-clientUpgrade toolbox-debuginfoUpgrade slirp4netns-debuginfoUpgrade runcUpgrade python3-osbuildUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade osbuild-composer-workerUpgrade osbuild-composer-worker-debuginfoUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade delve-debuginfoUpgrade golang-srcUpgrade podman-catatonitUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade osbuild-composer-debuginfoUpgrade libslirpUpgrade cockpit-composerUpgrade osbuild-composer-core-debuginfoUpgrade weldr-client-debugsourceUpgrade podman-testsUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade golang-raceUpgrade criuUpgrade buildah-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade golang-miscUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade osbuild-selinuxUpgrade slirp4netnsUpgrade golangUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-debuginfoUpgrade netavarkUpgrade delve-debugsourceUpgrade osbuild-composer-coreUpgrade toolboxUpgrade libslirp-develUpgrade criu-debuginfoUpgrade osbuild-composer-debugsourceUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade python3-podmanUpgrade podman-dockerUpgrade osbuild-composer-dnf-jsonUpgrade podman-gvproxyUpgrade cockpit-podman | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade delve-debugsourceUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade netavarkUpgrade skopeo-debugsourceUpgrade fuse-overlayfsUpgrade golang-binUpgrade criuUpgrade toolbox-testsUpgrade golangUpgrade buildahUpgrade skopeoUpgrade critUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade golang-raceUpgrade buildah-debuginfoUpgrade toolboxUpgrade skopeo-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade runcUpgrade buildah-testsUpgrade libslirp-debugsourceUpgrade crunUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade go-toolsetUpgrade libslirp-develUpgrade delveUpgrade fuse-overlayfs-debugsourceUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade buildah-debugsourceUpgrade containers-commonUpgrade conmonUpgrade delve-debuginfoUpgrade python3-criuUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsource | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.19-docUpgrade go1.18-docUpgrade go1.18-opensslUpgrade go1.18-openssl-raceUpgrade go1.19-raceUpgrade go1.19Upgrade go1.18-openssl-docUpgrade go1.18Upgrade go1.18-race | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.18-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-goUpgrade golang-1.18-goUpgrade golang-1.13 | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub