CVE-2014-125026

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@golang.org

Published

2022-12-27

Last modified

2025-04-11

Weaknesses

CWE-787

Affected products

• Golz4 (Cloudflare)
• Github.comcloudflaregolz4 (Github.comcloudflaregolz4)

References

• https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898
• https://github.com/cloudflare/golz4/issues/5
• https://pkg.go.dev/vuln/GO-2020-0022