Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "1.16.10"
},
{
"introduced": "1.17.0"
},
{
"fixed": "1.17.3"
}
]
}