HIGH7.5Go
GHSA-25xm-hr59-7c27· CVE-2021-29482, GO-2020-0016github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)
Modified: 7/8/2026
package
Go/github.com/ulikunitz/xz
pkg:go/github.com/ulikunitz/xz
MEDIUM5.3Go
GHSA-jc7w-c686-c4v9· CVE-2025-58058, GO-2025-3922github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives
Modified: 9/10/2026
—Go
GO-2020-0016· CVE-2021-29482, GHSA-25xm-hr59-7c27Infinite loop in github.com/ulikunitz/xz
Modified: 5/20/2024
—Go
GO-2025-3922· CVE-2025-58058, GHSA-jc7w-c686-c4v9Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz
Modified: 2/4/2026