---
id: CVE-2021-29482
title: >-
  ulikunitz/xz: Infinite loop in readUvarint allows for denial of service
  (CVE-2021-29482)
summary: >-
  A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not
  terminate a loop what could lead to denial of service (DoS).
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-835
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - migration_toolkit_for_containers
  - advanced_cluster_management_for_kubernetes 2
  - openshift_container_platform 4
  - openshift_virtualization 2
  - openstack_platform 16.2
  - quay 3
  - cnv_4_8_for_rhel 8
  - 8base_oadp_1_0
  - openshift_service_mesh 2.0
patched:
  - cnv_4_8_for_rhel 8
  - 8base_oadp_1_0
  - openshift_service_mesh 2.0
  - openstack_platform 16.2
published: '2020-08-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T04:25:54+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json
  - url: 'https://access.redhat.com/security/cve/CVE-2021-29482'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1954368'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2021-29482'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-29482'
  - url: 'https://access.redhat.com/errata/RHSA-2021:2920'
  - url: 'https://access.redhat.com/errata/RHSA-2022:0687'
  - url: 'https://access.redhat.com/errata/RHSA-2022:1276'
  - url: 'https://access.redhat.com/errata/RHSA-2022:2183'
  - url: 'https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27'
  - url: 'https://github.com/ulikunitz/xz/issues/35'
  - url: >-
      https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b
  - url: 'https://pkg.go.dev/vuln/GO-2020-0016'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.01438
epssPercentile: 0.73008
aliases:
  - GHSA-25xm-hr59-7c27
  - GO-2020-0016
ecosystem: go
ingestedAt: '2026-07-09T18:56:35.425Z'
---

## Overview

A flaw was found in github.com/ulikunitz/xz. The function readUvarint may not terminate a loop what could lead to denial of service (DoS).

## Vendor advisories

- **RHSA-2021:2920** · Red Hat · fixed in: CNV 4.8 for RHEL 8 · released 2021-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2021:2920)
- **RHSA-2022:0687** · Red Hat · fixed in: 8Base-OADP-1.0 · released 2022-02-28 · [advisory](https://access.redhat.com/errata/RHSA-2022:0687)
- **RHSA-2022:1276** · Red Hat · fixed in: OpenShift Service Mesh 2.0 · released 2022-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:1276)
- **RHSA-2022:2183** · Red Hat · fixed in: Red Hat OpenStack Platform 16.2 · released 2022-05-11 · [advisory](https://access.redhat.com/errata/RHSA-2022:2183)
- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Containers, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 2, Red Hat OpenStack Platform 16.2, Red Hat Quay 3 · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Migration Toolkit for Containers, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29482.json)

**ulikunitz/xz: Infinite loop in readUvarint allows for denial of service** — rated Moderate by Red Hat. Released 2021-01-01, updated 2026-10-16.

Affected:

- Migration Toolkit for Containers
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Virtualization 2
- Red Hat OpenStack Platform 16.2
- Red Hat Quay 3

Fixed:

- CNV 4.8 for RHEL 8
- 8Base-OADP-1.0
- OpenShift Service Mesh 2.0
- Red Hat OpenStack Platform 16.2

No fix planned:

- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Migration Toolkit for Containers
- Red Hat OpenShift Virtualization 2
- Red Hat Quay 3

Not affected:

- 8Base-OADP-1.0
- OpenShift Service Mesh 2.0
- Red Hat OpenStack Platform 16.2
- Migration Toolkit for Containers
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenShift Virtualization 2

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:2920
For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2022:0687
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html https://access.redhat.com/errata/RHSA-2022:1276

## Package advisory (CVE-2021-29482)

Affected packages:

- `github.com/ulikunitz/xz < 0.5.8`

Patched in:

- `github.com/ulikunitz/xz 0.5.8`

Source: https://osv.dev/vulnerability/GHSA-25xm-hr59-7c27