In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
{ "binaries": [ { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-go" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-go-shared-dev" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "golang-1.8-src" }, { "binary_version": "1.8.3-2ubuntu1.18.04.1", "binary_name": "libgolang-1.8-std1" } ] }