Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade golang-raceUpgrade podman-gvproxyUpgrade libslirp-develUpgrade libslirpUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-catatonitUpgrade golang-testsUpgrade containers-commonUpgrade toolboxUpgrade conmonUpgrade criuUpgrade netavarkUpgrade golang-miscUpgrade buildahUpgrade podmanUpgrade golang-srcUpgrade criu-libsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade osbuild-composer-coreUpgrade toolbox-testsUpgrade skopeoUpgrade osbuild-composer-workerUpgrade containernetworking-pluginsUpgrade weldr-clientUpgrade delveUpgrade golang-docsUpgrade podman-remoteUpgrade golang-binUpgrade go-toolsetUpgrade skopeo-testsUpgrade osbuild-composerUpgrade podman-dockerUpgrade udicaUpgrade crunUpgrade podman-testsUpgrade runcUpgrade osbuild-composer-dnf-jsonUpgrade python3-criuUpgrade criu-develUpgrade podman-pluginsUpgrade container-selinuxUpgrade crit | Jan 26, 2023 | Oct 14, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Oct 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade runcUpgrade golangUpgrade golang-docsUpgrade dockerUpgrade golang-binUpgrade containerd-stressUpgrade golist-debuginfoUpgrade golistUpgrade containerdUpgrade docker-debuginfoUpgrade golang-miscUpgrade runc-debuginfoUpgrade golang-raceUpgrade golang-sharedUpgrade containerd-debuginfoUpgrade golang-src | Dec 7, 2022 | Oct 14, 2022 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-miscUpgrade golang-sharedUpgrade golang-srcUpgrade golang-raceUpgrade golistUpgrade golist-debuginfoUpgrade golang-binUpgrade golang-docsUpgrade golist-debugsourceUpgrade golang-tests | Feb 17, 2025 | Oct 4, 2022 |
| Centos_linux | — | Upgrade cockpit-composerUpgrade podman-testsUpgrade go-toolsetUpgrade python3-osbuildUpgrade crun-debuginfoUpgrade osbuild-composer-debuginfoUpgrade osbuild-ostreeUpgrade podman-remote-debuginfoUpgrade weldr-client-debuginfoUpgrade runc-debuginfoUpgrade delve-debuginfoUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade libslirp-develUpgrade osbuild-luks2Upgrade podman-pluginsUpgrade osbuild-composer-workerUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-composer-core-debuginfoUpgrade weldr-client-debugsourceUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade skopeo-testsUpgrade golang-srcUpgrade weldr-clientUpgrade cockpit-podmanUpgrade container-selinuxUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade criu-develUpgrade toolbox-debuginfoUpgrade skopeo-debuginfoUpgrade weldr-client-tests-debuginfoUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade libslirpUpgrade osbuild-lvm2Upgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade osbuild-selinuxUpgrade podman-gvproxyUpgrade osbuild-composer-dnf-jsonUpgrade buildah-debugsourceUpgrade toolbox-debugsourceUpgrade delve-debugsourceUpgrade libslirp-debuginfoUpgrade golang-raceUpgrade udicaUpgrade podman-catatonit-debuginfoUpgrade toolboxUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade golang-docsUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade skopeoUpgrade buildahUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade osbuild-composer-debugsourceUpgrade toolbox-testsUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade osbuild-composerUpgrade netavarkUpgrade golang-miscUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golangUpgrade podman-debuginfoUpgrade runcUpgrade osbuild-composer-worker-debuginfoUpgrade criuUpgrade aardvark-dnsUpgrade podman-dockerUpgrade golang-testsUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade podmanUpgrade containernetworking-pluginsUpgrade skopeo-debugsourceUpgrade osbuildUpgrade golang-bin | Jan 24, 2023 | Oct 14, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Oct 14, 2022 |
| Freebsd | — | Upgrade go119Upgrade go118 | Nov 4, 2022 | Oct 4, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Nov 27, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Feb 13, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jan 6, 2023 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-binUpgrade golang-src | Dec 9, 2022 | Oct 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jan 9, 2023 | Oct 14, 2022 |
| Oracle_linux | — | Upgrade aardvark-dnsUpgrade python3-osbuildUpgrade osbuild-luks2Upgrade golang-miscUpgrade buildahUpgrade criu-libsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade go-toolsetUpgrade osbuild-ostreeUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade criuUpgrade golangUpgrade osbuild-lvm2Upgrade podmanUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade golang-srcUpgrade netavarkUpgrade osbuild-composerUpgrade osbuildUpgrade osbuild-composer-coreUpgrade podman-remoteUpgrade python3-podmanUpgrade critUpgrade golang-docsUpgrade conmonUpgrade golang-raceUpgrade golang-binUpgrade podman-catatonitUpgrade golang-testsUpgrade crunUpgrade skopeo-testsUpgrade skopeoUpgrade runcUpgrade osbuild-composer-workerUpgrade weldr-clientUpgrade python3-criuUpgrade podman-pluginsUpgrade osbuild-selinuxUpgrade osbuild-composer-dnf-jsonUpgrade container-selinuxUpgrade libslirpUpgrade podman-gvproxyUpgrade podman-dockerUpgrade udicaUpgrade cockpit-composerUpgrade slirp4netnsUpgrade podman-testsUpgrade delveUpgrade criu-develUpgrade cockpit-podman | Jan 24, 2023 | Oct 4, 2022 |
| Redhat Openshift | — | Upgrade buildahUpgrade openshift-clientsUpgrade podmanUpgrade skopeoUpgrade conmon | Jan 26, 2023 | Oct 14, 2022 |
| Redhat_linux | — | Upgrade runcUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade osbuild-luks2Upgrade containernetworking-plugins-debuginfoUpgrade buildahUpgrade criu-libs-debuginfoUpgrade delveUpgrade osbuild-lvm2Upgrade osbuildUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade weldr-client-debuginfoUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade golang-binUpgrade golang-testsUpgrade golang-docsUpgrade python3-osbuildUpgrade udicaUpgrade criu-debugsourceUpgrade critUpgrade podman-remoteUpgrade buildah-testsNo solution existsUpgrade crun-debugsourceUpgrade conmon-debuginfoUpgrade criu-develUpgrade weldr-clientUpgrade osbuild-ostreeUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade toolbox-debugsourceUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade toolbox-testsUpgrade osbuild-composerUpgrade osbuild-composer-tests-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade osbuild-composer-workerUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade skopeo-testsUpgrade weldr-client-tests-debuginfoUpgrade skopeo-debugsourceUpgrade podman-catatonit-debuginfoUpgrade skopeo-debuginfoUpgrade podman-dockerUpgrade criu-libsUpgrade osbuild-composer-coreUpgrade slirp4netnsUpgrade weldr-client-debugsourceUpgrade cockpit-podmanUpgrade buildah-tests-debuginfoUpgrade osbuild-composer-debuginfoUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-selinuxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podman-testsUpgrade buildah-debugsourceUpgrade skopeoUpgrade golang-raceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade conmon-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade buildah-debuginfoUpgrade golang-srcUpgrade conmonUpgrade golangUpgrade golang-miscUpgrade toolboxUpgrade osbuild-composer-core-debuginfoUpgrade cockpit-composerUpgrade delve-debugsourceUpgrade netavarkUpgrade osbuild-composer-debugsourceUpgrade python3-podmanUpgrade podman-pluginsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade criu-debuginfoUpgrade podman-gvproxyUpgrade criuUpgrade delve-debuginfo | Jan 24, 2023 | Oct 14, 2022 |
| Rocky_linux | — | Upgrade toolbox-debugsourceUpgrade buildah-testsUpgrade aardvark-dnsUpgrade delve-debugsourceUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade runcUpgrade criu-debuginfoUpgrade criu-debugsourceUpgrade criuUpgrade golangUpgrade containernetworking-pluginsUpgrade runc-debugsourceUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade toolboxUpgrade critUpgrade golang-binUpgrade golang-raceUpgrade netavarkUpgrade criu-libs-debuginfoUpgrade conmonUpgrade delveUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade go-toolsetUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade conmon-debuginfoUpgrade buildah-debugsourceUpgrade python3-criuUpgrade libslirp-develUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirpUpgrade slirp4netns-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debuginfo | Mar 12, 2024 | Oct 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Oct 14, 2022 |
| Suse | — | Upgrade go1.18-docUpgrade go1.19-docUpgrade go1.18-opensslUpgrade go1.19-raceUpgrade go1.18-openssl-raceUpgrade go1.19Upgrade go1.18-openssl-docUpgrade go1.18Upgrade go1.18-race | Oct 26, 2022 | Oct 14, 2022 |
| Ubuntu | — | Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.18Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.13Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-go | May 1, 2023 | Oct 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub