What’s Vulnerable › Vulnerabilities

CVE-2020-16845

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-06 · updated 2026-06-17
• Weakness: CWE-835

Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Affected products

• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 31, 32
• Go: before 1.13.15; from 1.14 before 1.14.7 — fixed in 1.13.15, 1.14.7
• openSUSE Leap: 15.1, 15.2

How to fix

Upgrade to a fixed version: Go 1.13.15, 1.14.7. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html
• https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo
• https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q
• https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html
• https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/

Get alerted when CVE-2020-16845 or the next vulnerability affects your stack