{"id":"CVE-2021-29482","title":"ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)","summary":"A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-835","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["migration_toolkit_for_containers","advanced_cluster_management_for_kubernetes 2","openshift_container_platform 4","openshift_virtualization 2","openstack_platform 16.2","quay 3","cnv_4_8_for_rhel 8","8base_oadp_1_0","openshift_service_mesh 2.0"],"patched":["cnv_4_8_for_rhel 8","8base_oadp_1_0","openshift_service_mesh 2.0","openstack_platform 16.2"],"published":"2020-08-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T04:25:54+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json"},{"url":"https://access.redhat.com/security/cve/CVE-2021-29482"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954368"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29482"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29482"},{"url":"https://access.redhat.com/errata/RHSA-2021:2920"},{"url":"https://access.redhat.com/errata/RHSA-2022:0687"},{"url":"https://access.redhat.com/errata/RHSA-2022:1276"},{"url":"https://access.redhat.com/errata/RHSA-2022:2183"},{"url":"https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27"},{"url":"https://github.com/ulikunitz/xz/issues/35"},{"url":"https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b"},{"url":"https://pkg.go.dev/vuln/GO-2020-0016"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.01438,"epssPercentile":0.73008,"aliases":["GHSA-25xm-hr59-7c27","GO-2020-0016"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:35.425Z","slug":"CVE-2021-29482","body":"## Overview\n\nA flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2021:2920** · Red Hat · fixed in: CNV 4.8 for RHEL 8 · released 2021-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2021:2920)\n- **RHSA-2022:0687** · Red Hat · fixed in: 8Base-OADP-1.0 · released 2022-02-28 · [advisory](https://access.redhat.com/errata/RHSA-2022:0687)\n- **RHSA-2022:1276** · Red Hat · fixed in: OpenShift Service Mesh 2.0 · released 2022-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:1276)\n- **RHSA-2022:2183** · Red Hat · fixed in: Red Hat OpenStack Platform 16.2 · released 2022-05-11 · [advisory](https://access.redhat.com/errata/RHSA-2022:2183)\n- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Containers, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 2, Red Hat OpenStack Platform 16.2, Red Hat Quay 3 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Migration Toolkit for Containers, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json)\n\n**ulikunitz/xz: Infinite loop in readUvarint allows for denial of service** — rated Moderate by Red Hat. Released 2021-01-01, updated 2026-10-16.\n\nAffected:\n\n- Migration Toolkit for Containers\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Virtualization 2\n- Red Hat OpenStack Platform 16.2\n- Red Hat Quay 3\n\nFixed:\n\n- CNV 4.8 for RHEL 8\n- 8Base-OADP-1.0\n- OpenShift Service Mesh 2.0\n- Red Hat OpenStack Platform 16.2\n\nNo fix planned:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Migration Toolkit for Containers\n- Red Hat OpenShift Virtualization 2\n- Red Hat Quay 3\n\nNot affected:\n\n- 8Base-OADP-1.0\n- OpenShift Service Mesh 2.0\n- Red Hat OpenStack Platform 16.2\n- Migration Toolkit for Containers\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Container Platform Assisted Installer 1\n- Red Hat OpenShift Virtualization 2\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:2920\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2022:0687\nThe OpenShift Service Mesh release notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html https://access.redhat.com/errata/RHSA-2022:1276\n\n## Package advisory (CVE-2021-29482)\n\nAffected packages:\n\n- `github.com/ulikunitz/xz < 0.5.8`\n\nPatched in:\n\n- `github.com/ulikunitz/xz 0.5.8`\n\nSource: https://osv.dev/vulnerability/GHSA-25xm-hr59-7c27","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}