Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-binUpgrade podman-remoteUpgrade golang-docsUpgrade runcUpgrade crunUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade criu-develUpgrade osbuild-composer-workerUpgrade delveUpgrade go-toolsetUpgrade skopeo-testsUpgrade podman-testsUpgrade podman-dockerUpgrade osbuild-composerUpgrade weldr-clientUpgrade osbuild-composer-dnf-jsonUpgrade udicaUpgrade critUpgrade podman-pluginsUpgrade libslirpUpgrade criuUpgrade golangUpgrade buildahUpgrade toolboxUpgrade criu-libsUpgrade podman-gvproxyUpgrade golang-raceUpgrade containers-commonUpgrade slirp4netnsUpgrade libslirp-develUpgrade aardvark-dnsUpgrade skopeoUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade podman-catatonitUpgrade buildah-testsUpgrade golang-srcUpgrade golang-miscUpgrade toolbox-testsUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade osbuild-composer-coreUpgrade cockpit-podmanUpgrade golang-testsUpgrade conmon | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-srcUpgrade golist-debuginfoUpgrade golistUpgrade golang-raceUpgrade containerd-debuginfoUpgrade docker-debuginfoUpgrade runc-debuginfoUpgrade golang-sharedUpgrade containerdUpgrade golang-docsUpgrade golangUpgrade dockerUpgrade golang-binUpgrade runcUpgrade containerd-stressUpgrade golang-tests | Dec 7, 2022 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golist-debugsourceUpgrade golang-miscUpgrade golist-debuginfoUpgrade golangUpgrade golang-raceUpgrade golang-srcUpgrade golistUpgrade golang-shared | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade osbuildUpgrade criuUpgrade golang-docsUpgrade containernetworking-pluginsUpgrade golang-binUpgrade fuse-overlayfs-debuginfoUpgrade golang-testsUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade golangUpgrade buildahUpgrade criu-debuginfoUpgrade toolboxUpgrade osbuild-composer-worker-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade delve-debugsourceUpgrade aardvark-dnsUpgrade conmon-debugsourceUpgrade podmanUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade golang-raceUpgrade buildah-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade podman-debuginfoUpgrade golang-miscUpgrade netavarkUpgrade osbuild-composerUpgrade osbuild-composer-debugsourceUpgrade skopeoUpgrade libslirp-debuginfoUpgrade udicaUpgrade runcUpgrade critUpgrade toolbox-testsUpgrade buildah-testsUpgrade toolbox-debugsourceUpgrade golang-srcUpgrade skopeo-debuginfoUpgrade cockpit-composerUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade criu-develUpgrade osbuild-composer-core-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debuginfoUpgrade delveUpgrade conmonUpgrade toolbox-debuginfoUpgrade go-toolsetUpgrade osbuild-luks2Upgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade skopeo-testsUpgrade osbuild-selinuxUpgrade weldr-client-tests-debuginfoUpgrade criu-debugsourceUpgrade container-selinuxUpgrade weldr-clientUpgrade delve-debuginfoUpgrade containers-commonUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade libslirp-develUpgrade weldr-client-debuginfoUpgrade osbuild-composer-coreUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade python3-osbuildUpgrade podman-pluginsUpgrade osbuild-composer-debuginfoUpgrade criu-libsUpgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade osbuild-composer-dnf-jsonUpgrade weldr-client-debugsourceUpgrade osbuild-lvm2Upgrade runc-debugsourceUpgrade osbuild-composer-workerUpgrade libslirpUpgrade podman-plugins-debuginfoUpgrade osbuild-ostreeUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsource | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jan 9, 2023 | Oct 14, 2022 |
| Oracle_linux | — | Upgrade fuse-overlayfsUpgrade osbuildUpgrade osbuild-luks2Upgrade podman-remoteUpgrade criuUpgrade aardvark-dnsUpgrade buildahUpgrade golang-miscUpgrade osbuild-lvm2Upgrade netavarkUpgrade podmanUpgrade buildah-testsUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade python3-osbuildUpgrade containers-commonUpgrade golang-srcUpgrade go-toolsetUpgrade oci-seccomp-bpf-hookUpgrade osbuild-ostreeUpgrade libslirp-develUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade golangUpgrade python3-podmanUpgrade delveUpgrade slirp4netnsUpgrade podman-testsUpgrade golang-testsUpgrade udicaUpgrade podman-gvproxyUpgrade libslirpUpgrade podman-catatonitUpgrade cockpit-composerUpgrade critUpgrade conmonUpgrade osbuild-composer-workerUpgrade skopeoUpgrade golang-docsUpgrade python3-criuUpgrade podman-pluginsUpgrade osbuild-selinuxUpgrade osbuild-composer-dnf-jsonUpgrade container-selinuxUpgrade weldr-clientUpgrade runcUpgrade crunUpgrade criu-develUpgrade skopeo-testsUpgrade golang-raceUpgrade golang-binUpgrade cockpit-podmanUpgrade podman-docker | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade skopeoUpgrade openshift-clientsUpgrade conmonUpgrade podmanUpgrade buildah | Jan 26, 2023 | Oct 4, 2022 |
| Redhat_linux | — | Upgrade aardvark-dnsUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade osbuildUpgrade osbuild-composer-worker-debuginfoUpgrade skopeo-testsUpgrade critUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade osbuild-lvm2Upgrade weldr-client-debuginfoUpgrade criu-libs-debuginfoUpgrade osbuild-luks2Upgrade toolbox-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade golang-testsUpgrade container-selinuxUpgrade python3-osbuildUpgrade python3-criuUpgrade conmon-debuginfoUpgrade golang-binUpgrade osbuild-composer-tests-debuginfoUpgrade osbuild-composerUpgrade delveUpgrade libslirp-debugsourceUpgrade toolbox-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade runc-debugsourceUpgrade osbuild-composer-workerUpgrade slirp4netns-debuginfoUpgrade go-toolsetUpgrade libslirp-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade crun-debugsourceUpgrade containers-commonUpgrade toolbox-testsUpgrade osbuild-ostreeUpgrade weldr-clientUpgrade buildah-testsUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade udicaNo solution existsUpgrade criu-develUpgrade runcUpgrade osbuild-composer-debuginfoUpgrade slirp4netnsUpgrade toolboxUpgrade criu-debuginfoUpgrade libslirp-develUpgrade cockpit-composerUpgrade osbuild-composer-core-debuginfoUpgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade osbuild-composer-coreUpgrade criu-libsUpgrade osbuild-composer-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delve-debugsourceUpgrade osbuild-selinuxUpgrade weldr-client-debugsourceUpgrade weldr-client-tests-debuginfoUpgrade skopeo-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade crun-debuginfoUpgrade crunUpgrade podman-testsUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade golang-raceUpgrade buildah-debugsourceUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade delve-debuginfoUpgrade golangUpgrade golang-miscUpgrade conmonUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade python3-podmanUpgrade netavarkUpgrade golang-srcUpgrade osbuild-composer-dnf-jsonUpgrade criuUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade libslirp | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade conmonUpgrade libslirpUpgrade buildah-debugsourceUpgrade conmon-debuginfoUpgrade python3-criuUpgrade criu-libsUpgrade go-toolsetUpgrade slirp4netns-debuginfoUpgrade toolbox-debuginfoUpgrade crunUpgrade runc-debuginfoUpgrade delveUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containers-commonUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade delve-debuginfoUpgrade criu-libs-debuginfoUpgrade toolboxUpgrade golang-binUpgrade buildah-testsUpgrade runcUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade skopeoUpgrade netavarkUpgrade critUpgrade aardvark-dnsUpgrade buildahUpgrade golang-raceUpgrade conmon-debugsourceUpgrade golangUpgrade runc-debugsourceUpgrade criuUpgrade skopeo-debuginfoUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade toolbox-debugsourceUpgrade delve-debugsourceUpgrade criu-debuginfo | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.18-opensslUpgrade go1.18-openssl-docUpgrade go1.19-raceUpgrade go1.19Upgrade go1.18-openssl-raceUpgrade go1.18-raceUpgrade go1.18 | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13Upgrade golang-1.13-goUpgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-goUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-src | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub