CVE-2014-125026: Out-of-bounds Write

December 28, 2022 (updated January 9, 2023)

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

References

github.com/advisories/GHSA-4wp2-8rm2-jgmh
github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898
github.com/cloudflare/golz4/issues/5
nvd.nist.gov/vuln/detail/CVE-2014-125026
pkg.go.dev/vuln/GO-2020-0022

Code Behaviors & Features

Detect and mitigate CVE-2014-125026 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →