Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-docsUpgrade osbuild-composer-dnf-jsonUpgrade golang-binUpgrade container-selinuxUpgrade runcUpgrade osbuild-composer-workerUpgrade skopeo-testsUpgrade delveUpgrade weldr-clientUpgrade podman-testsUpgrade podman-pluginsUpgrade podman-dockerUpgrade udicaUpgrade go-toolsetUpgrade osbuild-composerUpgrade critUpgrade podman-remoteUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade crunUpgrade criu-develUpgrade conmonUpgrade podman-catatonitUpgrade golang-srcUpgrade criu-libsUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade golang-miscUpgrade golangUpgrade skopeoUpgrade python3-podmanUpgrade podmanUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade libslirp-develUpgrade netavarkUpgrade criuUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade golang-raceUpgrade toolbox-testsUpgrade libslirpUpgrade containers-commonUpgrade toolboxUpgrade golang-testsUpgrade cockpit-podmanUpgrade buildah-tests | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade runc-debuginfoUpgrade golistUpgrade docker-debuginfoUpgrade golang-raceUpgrade containerdUpgrade containerd-debuginfoUpgrade golang-srcUpgrade golist-debuginfoUpgrade golang-sharedUpgrade containerd-stressUpgrade golang-binUpgrade golang-docsUpgrade golang-testsUpgrade runcUpgrade golangUpgrade docker | Dec 7, 2022 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golistUpgrade golang-raceUpgrade golang-miscUpgrade golangUpgrade golang-sharedUpgrade golist-debuginfoUpgrade golang-srcUpgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golist-debugsource | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade toolbox-testsUpgrade buildah-debuginfoUpgrade osbuild-composerUpgrade buildah-testsUpgrade buildah-debugsourceUpgrade golang-docsUpgrade criuUpgrade golang-miscUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade critUpgrade podman-remoteUpgrade osbuild-composer-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade netavarkUpgrade podman-catatonit-debuginfoUpgrade containernetworking-pluginsUpgrade golang-binUpgrade skopeo-debugsourceUpgrade osbuildUpgrade delve-debugsourceUpgrade osbuild-composer-tests-debuginfoUpgrade runcUpgrade skopeoUpgrade golang-raceUpgrade golang-testsUpgrade libslirp-debuginfoUpgrade podman-dockerUpgrade fuse-overlayfs-debuginfoUpgrade python3-podmanUpgrade toolboxUpgrade podman-catatonitUpgrade udicaUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade osbuild-composer-worker-debuginfoUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade containernetworking-plugins-debugsourceUpgrade golangUpgrade criu-debuginfoUpgrade osbuild-selinuxUpgrade containers-commonUpgrade osbuild-composer-workerUpgrade slirp4netns-debugsourceUpgrade weldr-client-tests-debuginfoUpgrade weldr-clientUpgrade skopeo-testsUpgrade criu-debugsourceUpgrade container-selinuxUpgrade cockpit-podmanUpgrade golang-srcUpgrade podman-testsUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade osbuild-composer-core-debuginfoUpgrade weldr-client-debugsourceUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade containernetworking-plugins-debuginfoUpgrade delve-debuginfoUpgrade weldr-client-debuginfoUpgrade osbuild-composer-coreUpgrade crun-debuginfoUpgrade buildah-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade python3-criuUpgrade podman-plugins-debuginfoUpgrade osbuild-lvm2Upgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade go-toolsetUpgrade delveUpgrade conmonUpgrade toolbox-debuginfoUpgrade osbuild-luks2Upgrade oci-seccomp-bpf-hookUpgrade crunUpgrade conmon-debuginfoUpgrade skopeo-debuginfoUpgrade libslirp-debugsourceUpgrade cockpit-composerUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade python3-osbuildUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade osbuild-ostreeUpgrade osbuild-composer-debuginfoUpgrade libslirp-develUpgrade criu-libs | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go118Upgrade go119 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade go-toolsetUpgrade fuse-overlayfsUpgrade netavarkUpgrade osbuildUpgrade criu-libsUpgrade osbuild-ostreeUpgrade golangUpgrade osbuild-composerUpgrade libslirp-develUpgrade osbuild-composer-coreUpgrade python3-podmanUpgrade osbuild-luks2Upgrade buildah-testsUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade osbuild-lvm2Upgrade podman-remoteUpgrade containers-commonUpgrade golang-srcUpgrade podmanUpgrade python3-osbuildUpgrade buildahUpgrade golang-miscUpgrade podman-dockerUpgrade golang-docsUpgrade conmonUpgrade skopeoUpgrade udicaUpgrade slirp4netnsUpgrade delveUpgrade podman-catatonitUpgrade podman-testsUpgrade critUpgrade osbuild-composer-workerUpgrade crunUpgrade runcUpgrade golang-raceUpgrade golang-testsUpgrade weldr-clientUpgrade python3-criuUpgrade podman-pluginsUpgrade osbuild-selinuxUpgrade osbuild-composer-dnf-jsonUpgrade container-selinuxUpgrade criu-develUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade golang-binUpgrade cockpit-composerUpgrade libslirpUpgrade podman-gvproxy | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade skopeoUpgrade conmonUpgrade podmanUpgrade openshift-clientsUpgrade buildah | Jan 26, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade osbuild-lvm2Upgrade toolbox-debuginfoUpgrade weldr-client-debuginfoUpgrade libslirp-debuginfoNo solution existsUpgrade podmanUpgrade criu-develUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade go-toolsetUpgrade conmon-debuginfoUpgrade osbuild-composerUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade podman-debuginfoUpgrade container-selinuxUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade libslirp-debugsourceUpgrade python3-osbuildUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade critUpgrade toolbox-debugsourceUpgrade podman-plugins-debuginfoUpgrade runcUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade golang-binUpgrade python3-criuUpgrade aardvark-dnsUpgrade golang-docsUpgrade buildah-testsUpgrade udicaUpgrade slirp4netns-debugsourceUpgrade osbuildUpgrade osbuild-luks2Upgrade podman-debugsourceUpgrade buildahUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade weldr-clientUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-debugsourceUpgrade osbuild-composer-workerUpgrade osbuild-ostreeUpgrade criu-libsUpgrade golang-miscUpgrade fuse-overlayfs-debuginfoUpgrade cockpit-composerUpgrade weldr-client-debugsourceUpgrade golangUpgrade osbuild-composer-coreUpgrade toolboxUpgrade libslirpUpgrade delve-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade netavarkUpgrade python3-podmanUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade osbuild-composer-debugsourceUpgrade conmon-debugsourceUpgrade crun-debuginfoUpgrade fuse-overlayfsUpgrade weldr-client-tests-debuginfoUpgrade conmonUpgrade delve-debuginfoUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade crunUpgrade osbuild-selinuxUpgrade osbuild-composer-core-debuginfoUpgrade golang-srcUpgrade podman-gvproxyUpgrade osbuild-composer-dnf-jsonUpgrade skopeoUpgrade criuUpgrade cockpit-podmanUpgrade podman-testsUpgrade golang-raceUpgrade buildah-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade aardvark-dnsUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade golangUpgrade criuUpgrade skopeo-debuginfoUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade toolbox-testsUpgrade buildah-testsUpgrade criu-debuginfoUpgrade criu-debugsourceUpgrade delve-debugsourceUpgrade runcUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade toolbox-debugsourceUpgrade critUpgrade netavarkUpgrade golang-binUpgrade golang-raceUpgrade toolboxUpgrade buildahUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade criu-develUpgrade libslirp-debugsourceUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade conmon-debuginfoUpgrade python3-criuUpgrade crun-debuginfoUpgrade skopeo-testsUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade criu-libsUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade go-toolsetUpgrade delveUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade delve-debuginfoUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade crun-debugsource | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.19-docUpgrade go1.18-opensslUpgrade go1.18-docUpgrade go1.18Upgrade go1.18-openssl-docUpgrade go1.19-raceUpgrade go1.18-raceUpgrade go1.19Upgrade go1.18-openssl-race | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.18Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.18-srcUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13-go | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub