Is CVE-2020-16845 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-16845 being exploited in the wild.

How severe is CVE-2020-16845?

High severity, with a CVSS score of 7.5, published 16 December 2021.

Which products and versions are affected?

github.com/ulikunitz/xz (Go) < 0.5.8, SEMVER:introduced=0,fixed=0.5.8; stdlib (Go) SEMVER:introduced=0,fixed=1.13.15,introduced=1.14.0-0,fixed=1.14.7.

Is there a fix for CVE-2020-16845?

Yes. github.com/ulikunitz/xz (Go): upgrade to 0.5.8 or later; stdlib (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-16845 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-16845?

Check whether you run github.com/ulikunitz/xz (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-16845: Go encoding/binary infinite loop in ReadUvarint and ReadVarint

Q: Is there a fix for CVE-2020-16845?

Yes. github.com/ulikunitz/xz (Go): upgrade to 0.5.8 or later; stdlib (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-16845 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-16845?

Check whether you run github.com/ulikunitz/xz (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-16845 · Severity: high · CVSS 7.5 · Published 2021-12-16

The Go standard library's encoding/binary package contains functions that can enter an infinite loop when processing specially crafted invalid input. This vulnerability allows a remote attacker to cause a denial of service by sending malicious data to applications that use these functions, consuming CPU resources indefinitely and making the service unavailable.

Technologies: github.com/ulikunitz/xz (Go), stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2020-16845 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-16845 being exploited in the wild.
How severe is CVE-2020-16845?: High severity, with a CVSS score of 7.5, published 16 December 2021.
Which products and versions are affected?: github.com/ulikunitz/xz (Go) < 0.5.8, SEMVER:introduced=0,fixed=0.5.8; stdlib (Go) SEMVER:introduced=0,fixed=1.13.15,introduced=1.14.0-0,fixed=1.14.7.
Is there a fix for CVE-2020-16845?: Yes. github.com/ulikunitz/xz (Go): upgrade to 0.5.8 or later; stdlib (Go): upgrade to 1.14.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-16845 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-16845?: Check whether you run github.com/ulikunitz/xz (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/ulikunitz/xz (Go): upgrade to 0.5.8 or later
```
go get github.com/ulikunitz/xz@v0.5.8
```
stdlib (Go): upgrade to 1.14.7 or later
```
go get stdlib@v1.14.7
```

Technical details

This vulnerability is a denial-of-service issue in the encoding/binary package's ReadUvarint and ReadVarint functions. When processing variable-length integer encoded data, these functions can receive input bytes that lack a proper termination condition, causing the read loop to continue indefinitely. The vulnerability requires network-accessible input to the affected functions but no authentication or special privileges. An attacker can exploit this by sending malformed varint-encoded data to an application, causing CPU resource exhaustion and service unavailability. The fix, implemented in Go 1.13.15 and 1.14.7, adds a check to limit the number of bytes read (maximum 10 bytes for 64-bit varint) before returning an overflow error. The same vulnerability was independently discovered and fixed in the third-party ulikunitz/xz Go library (patched in version 0.5.8).

Affected products

Go Go standard library before 1.13.15 and 1.14.x before 1.14.7
ulikunitz xz before 0.5.8

Identifiers

CVE-2020-16845
GHSA-q6gq-997w-f55g
GO-2021-0142

Timeline

2020-08-06: disclosed: Vulnerability disclosed via NVD
2020-08: other: Vulnerability reported to ulikunitz/xz project
2020: patched: Go 1.13.15 and 1.14.7 released with fixes
2020: patched: ulikunitz/xz version 0.5.8 released with fix
2021-12-16: advisory: Published to GitHub Advisory Database
2025-10-14: other: Advisory withdrawn from GitHub because alerts cannot be issued for Go standard library

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.