CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

• CWE-835

• https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9bPatch, Third Party Advisory
• https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27Third Party Advisory
• https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9bPatch, Third Party Advisory
• https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27Third Party Advisory

Published

Apr 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29476Requests is a HTTP library written in PHP. Requests mishandl…9.8
• CVE-2021-29477Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-29478Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-29479Ratpack is a toolkit for creating web applications. In versi…6.1
• CVE-2021-29480Ratpack is a toolkit for creating web applications. In versi…3.1
• CVE-2021-29481Ratpack is a toolkit for creating web applications. In versi…7.5
• CVE-2021-29483ManageWiki is an extension to the MediaWiki project. The 'wi…7.5
• CVE-2021-29484Ghost is a Node.js CMS. An unused endpoint added during the …6.8
• CVE-2021-29485Ratpack is a toolkit for creating web applications. In versi…8.8
• CVE-2021-29486cumulative-distribution-function is an open source npm libra…7.5
• CVE-2021-29487octobercms in a CMS platform based on the Laravel PHP Framew…7.4
• CVE-2021-29488SABnzbd is an open source binary newsreader. A vulnerability…5.3