CVE-2021-29482: denial of service in github.com/ulikunitz/xz

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-28 · updated 2026-06-17
Weakness: CWE-835

Description

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

Affected products

ulikunitz xz: before 0.5.8 — fixed in 0.5.8

How to fix

Upgrade to a fixed version: ulikunitz xz 0.5.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-29482 or the next vulnerability affects your stack