title: Out-of-bounds write in github.com/cloudflare/golz4
description: LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
problem types: CWE 94: Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: github.com/cloudflare/golz4
product: github.com/cloudflare/golz4
collectionURL: https://pkg.go.dev
packageName: github.com/cloudflare/golz4
versions:
version: 0, lessThan: 0.0.0-20140711154735-199f5f787806, status: affected, versionType: semver
programRoutines:
name: Uncompress
defaultStatus: unaffected
}