High severity7.5NVD Advisory· Published Aug 6, 2020· Updated Jun 17, 2026
CVE-2020-16845
CVE-2020-16845
Description
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ulikunitz/xzGo | < 0.5.8 | 0.5.8 |
Affected products
11- Go/Godescription
- osv-coords10 versionspkg:bitnami/golangpkg:golang/github.com/ulikunitz/xzpkg:rpm/opensuse/go1.13&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/go1.13&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/go1.13&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/go1.14&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/go1.14&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/go1.14&distro=openSUSE%20Tumbleweedpkg:rpm/suse/go1.14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1pkg:rpm/suse/go1.14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2
< 1.13.15+ 9 more
- (no CPE)range: < 1.13.15
- (no CPE)range: < 0.5.8
- (no CPE)range: < 1.13.15-lp151.8.1
- (no CPE)range: < 1.13.15-lp152.2.7.1
- (no CPE)range: < 1.13.15-2.6
- (no CPE)range: < 1.14.7-lp151.13.1
- (no CPE)range: < 1.14.7-lp152.2.3.1
- (no CPE)range: < 1.14.15-1.6
- (no CPE)range: < 1.14.7-1.15.1
- (no CPE)range: < 1.14.7-1.15.1
Patches
Vulnerability mechanics
References
26- lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.htmlnvdMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.htmlnvdMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.htmlnvdMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.htmlnvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-q6gq-997w-f55gghsaADVISORY
- lists.debian.org/debian-lts-announce/2020/11/msg00037.htmlnvdMailing ListThird Party AdvisoryWEB
- lists.debian.org/debian-lts-announce/2020/11/msg00038.htmlnvdMailing ListThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-16845ghsaADVISORY
- security.netapp.com/advisory/ntap-20200924-0002/nvdThird Party Advisory
- www.debian.org/security/2021/dsa-4848nvdThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuApr2021.htmlnvdThird Party AdvisoryWEB
- github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9bghsaWEB
- github.com/ulikunitz/xz/issues/35ghsaWEB
- groups.google.com/forum/ghsaWEB
- groups.google.com/forum/ghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XUghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FOghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7OghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4ghsaWEB
- security.netapp.com/advisory/ntap-20200924-0002ghsaWEB
- groups.google.com/forum/nvd
- groups.google.com/forum/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/nvd
News mentions
0No linked articles in our index yet.