HIGHCVSS 7.5EPSS 4.7%

CVE-2020-16845

Withdrawn Advisory: Infinite loop in xz

Published: 2021-12-16
Modified: 2026-08-21
EPSS percentile: 91%
Aliases: GHSA-q6gq-997w-f55g
Sources: github-advisory

Summary

### Withdrawn Advisory This advisory has been withdrawn because alerts cannot be issued for the Go standard library at this time. ### Original Description Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/ulikunitz/xz	—	0.5.8

Remediation: Upgrade to 0.5.8 or later.

References

https://github.com/advisories/GHSA-q6gq-997w-f55g

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.