-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unbounded JSON parsing in OCI image imports. The commit diff shows the vulnerable onUntarJSON function was modified to add a 20MB limit via io.LimitReader, replacing the dangerous io.ReadAll call. This function handles critical OCI metadata files during import, and the CWE-400/CWE-770 mapping confirms this is a resource exhaustion issue. While ImportIndex is mentioned in the Go vulnerability report, the direct vulnerability manifests in onUntarJSON which it likely calls.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containerd/containerd | go | >= 1.6.0, < 1.6.18 | 1.6.18 |
| github.com/containerd/containerd | go | < 1.5.18 | 1.5.18 |
Ongoing coverage of React2Shell