{"action":"Upgrade github.com/ulikunitz/xz to 0.5.8 or later.","affected":[{"fixed":"0.5.8","introduced":"0"}],"component":"github.com/ulikunitz/xz","cve_ids":["CVE-2021-29482"],"ecosystem":"Go","epss":0.01438,"exploited":false,"fixed_versions":["0.5.8"],"ghsa_id":"GHSA-25xm-hr59-7c27","id":"tcs_01M5KERHTY8BC4X3JMQQPYV2N7","modified_at":"2026-07-08T06:27:46.198772354Z","published_at":"2021-05-25T18:39:37Z","references":["https://osv.dev/vulnerability/GHSA-25xm-hr59-7c27","https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27","https://nvd.nist.gov/vuln/detail/CVE-2021-29482","https://github.com/ulikunitz/xz/issues/35","https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b","https://pkg.go.dev/vuln/GO-2020-0016"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-25xm-hr59-7c27","url":"https://osv.dev/vulnerability/GHSA-25xm-hr59-7c27"}],"summary":"github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)"}