Arbitrary Code Execution

2023-01-1107:27:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

lz4 decoder

arbitrary code execution

memory corruption

user input

software

EPSS

0.004

Percentile

72.7%

JSON

github.com/cloudflare/golz4 is vulnerable to arbitrary code execution. The vulnerability is due to the use of an unsafe version of the LZ4 decoder (LZ4_uncompress) which is used in the Uncompress function resulting in memory corruption via specially crafted user input.