-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from decompressors not enforcing size/count limits. The patch added FileSizeLimit and FilesLimit fields to all decompressor structs and passed them to untar/copyReader functions. Vulnerable versions used default Decompressors map created via init() with new() constructors that didn't set these limits, making their Decompress methods process input without resource constraints. The affected functions are the Decompress methods of all compression-type specific decompressors that handle archive processing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/go-getter | go | < 1.7.0 | 1.7.0 |
| github.com/hashicorp/go-getter/v2 | go | >= 2.0.0, < 2.2.0 | 2.2.0 |