CVE-2014-125026: Out-of-bounds write in github.com/cloudflare/golz4
Summary
CVE-2014-125026: Out-of-bounds write in github.com/cloudflare/golz4. Affects github.com/cloudflare/golz4 versions < 0.0.0-20140711154735-199f5f787806. Fixed in 0.0.0-20140711154735-199f5f787806. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/cloudflare/golz4, an LZ4 binding library for the Go programming language. LZ4 is a lossless compression algorithm that is commonly used for fast compression and decompression of data. The golz4 package provides Go bindings for the LZ4 C library, allowing Go developers to utilize LZ4 compression in their applications. However, the package uses a deprecated C API that is vulnerable to memory corruption.
Vulnerability Detail
The vulnerability in github.com/cloudflare/golz4 arises from the use of a deprecated C API in the LZ4 bindings. This vulnerability can be exploited through untrusted user input, potentially leading to arbitrary code execution. An attacker could craft malicious input that triggers an out-of-bounds write, corrupting memory and potentially executing arbitrary code. This poses a significant security risk to applications that utilize the golz4 package.
How To Fix
Latest published version: v0.0.0-20240916140612-caecf3c00c06 as of 22 Oct 2026
go get github.com/cloudflare/golz4@v0.0.0-20240916140612-caecf3c00c06Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20140711154735-199f5f787806
This is the first release that contains the fix.
go get github.com/cloudflare/golz4@v0.0.0-20140711154735-199f5f787806Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that untrusted user input is properly validated and sanitized before being passed to the golz4 package. By implementing strict input validation, the likelihood of triggering the vulnerability can be reduced.
Conclusion
The github.com/cloudflare/golz4 package is vulnerable to an out-of-bounds write vulnerability due to its use of a deprecated C API. This vulnerability can be exploited through untrusted user input, potentially leading to arbitrary code execution. Developers should update their dependencies to a version of the package that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/golz4 →
FAQ
github.com/cloudflare/golz4 is a Go package that provides LZ4 compression bindings for the Go programming language. It allows developers to utilize the LZ4 compression algorithm in their Go applications.
LZ4 is a lossless compression algorithm that is known for its fast compression and decompression speeds. It is commonly used in applications that require efficient data compression.
A deprecated C API is an interface provided by a library that is no longer recommended for use. It may still be supported for backward compatibility reasons, but developers are encouraged to migrate to newer APIs. Deprecated APIs often have known vulnerabilities or limitations.
Memory corruption refers to the unintended modification of data in a program's memory. It can occur due to programming errors or vulnerabilities and can lead to various issues, including crashes, data corruption, and potentially arbitrary code execution.
This vulnerability can be exploited by providing untrusted user input to the golz4 package. An attacker can craft malicious input that triggers an out-of-bounds write, corrupting memory and potentially executing arbitrary code.
