CVE-2014-125026

CRITICAL

cloudflare/golz4 < 0.0.0-20140711154735-199f5f787806 - Out-of-bounds Write via Deprecated C API

Title source: llm
STIX 2.1

Description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

References (3)

Core 3
Core References
Issue Tracking, Patch, Third Party Advisory
https://github.com/cloudflare/golz4/issues/5
Patch, Vendor Advisory
https://pkg.go.dev/vuln/GO-2020-0022

Scores

CVSS v3 9.8
EPSS 0.0106
EPSS Percentile 60.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-787
Status published
Products (2)
cloudflare/golz4 < 2014-07-11
cloudflare/golz4 0 - 0.0.0-20140711154735-199f5f787806Go
Published Dec 27, 2022
Tracked Since Feb 18, 2026