LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2020-0022" }
{ "imports": [ { "symbols": [ "Uncompress" ], "path": "github.com/cloudflare/golz4" } ] }