-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that the Decoder.DecodeAll function from github.com/klauspost/compress/zstd was the source of the vulnerability. The provided commit patch shows that the Decompress method within the compressor struct in internal/zstd/zstd.go was modified to remove the usage of c.decoder.DecodeAll. This directly addresses the vulnerability. The function compressor.Decompress was responsible for calling the vulnerable DecodeAll function, making it the key function involved in the vulnerability. The confidence is high because the patch directly modifies this function to remove the vulnerable call, and the commit message and vulnerability description corroborate this finding. The function signature compressor.Decompress is precise as it would appear in a Go profiler, including the receiver type.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mostynb/go-grpc-compression | go | >= 1.1.4, < 1.2.3 | 1.2.3 |
Ongoing coverage of React2Shell