GO-2021-0142 BIT-golang-2020-16845 CVE-2020-16845 GHSA-q6gq-997w-f55g

Unbounded read from invalid inputs in encoding/binary

High Go

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 4.86%; Chance of exploitation in the next 30 days. Higher than 92.04% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Fix: Available; 2 packages have a fixed version

Description

ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.

Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/ulikunitz/xz	`< 0.5.8`	`0.5.8`
stdlib	`< 1.13.15` `>= 1.14.0-0, < 1.14.7`	`1.13.15` `1.14.7`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/ulikunitz/xz Go → `0.5.8`

go

go get github.com/ulikunitz/xz@v0.5.8 && go mod tidy

stdlib Go → `1.14.7`

go

go get stdlib@v1.14.7 && go mod tidy

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2020-16845

Fixes and patches

Issue reports

go.dev/issue/40618

Timeline

Dec 16, 2021 Published
Oct 14, 2025 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-4374-p667-p6c8 HTTP/2 rapid reset can cause excessive work in net/http	High Known exploited	Also affects stdlib
CVE-2020-0601 Certificate validation bypass on Windows in crypto/x509	High Known exploited	Also affects stdlib
RUSTSEC-2026-0382 Distrust compromised intermediate certificates in crypto/x509	Medium	Also affects stdlib
GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http	High	Also affects stdlib
GO-2026-6609 Lack of limit on size of parsed Range headers in net/http	High	Also affects stdlib
GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart	High	Also affects stdlib
GO-2026-6607 Reject malformed ECH outer extension references in crypto/tls	High	Also affects stdlib
GO-2026-6604 Root.Mkdir(All) can follow junctions out of the root on Windows in os	Critical	Also affects stdlib

Credits: Diederik Loerakker, Jonny Rhea, Preston Van Loon, Raúl Kripalani

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor