CVE-2020-16845: Unbounded read from invalid inputs in encoding/binary
Summary
CVE-2020-16845: Unbounded read from invalid inputs in encoding/binary. Affects stdlib across 2 version ranges.
< 1.13.15
>= 1.14.0-0, < 1.14.7
Fixed in 1.13.15 or 1.14.7, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- github.com/ulikunitz/xz · Go
- golang-1.15 · Debian:11
The same CVE-2020-16845 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. One of the packages in the stdlib is encoding/binary, which provides binary encoding and decoding of data. This package includes functions like ReadUvarint and ReadVarint, which read variable-length integers from a byte stream. These functions are commonly used for network communication and data serialization. However, a vulnerability has been discovered in the encoding/binary package that allows unbounded reads from invalid inputs.
Vulnerability Detail
The vulnerability in the encoding/binary package arises from the ReadUvarint and ReadVarint functions. When these functions encounter certain invalid inputs, they can end up reading an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected, especially when the caller is reading directly from a network and relies on these functions to consume only a small, bounded number of bytes. The consequences of this vulnerability can include resource exhaustion, denial of service, or data corruption.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.151.13.15go get stdlib@v1.13.15 -
>= 1.14.0-0, < 1.14.71.14.7go get stdlib@v1.14.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing additional input validation and bounds checking before calling the ReadUvarint and ReadVarint functions. By ensuring that only valid inputs are passed to these functions, the risk of triggering the vulnerability can be reduced.
Conclusion
The vulnerability in the encoding/binary package can lead to unbounded reads from invalid inputs, potentially resulting in resource exhaustion, denial of service, or data corruption. Developers should update their Go installations to versions 1.13.15 or 1.14.7, or the latest stable version, to fix the vulnerability. Additionally, implementing proper input validation and bounds checking can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can result in unbounded reads from invalid inputs, leading to resource exhaustion, denial of service, or data corruption.
Versions 0.0.0 to 1.13.14 and 1.14.0 to 1.14.6 of the Go stdlib are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is advisable to patch the vulnerability as soon as possible to prevent any potential attacks.
Yes, the vulnerability has been fixed in versions 1.13.15 and 1.14.7 of the Go stdlib. It is recommended to upgrade to the latest stable version.
If upgrading to the fixed version is not feasible, it is recommended to implement additional input validation and bounds checking in your code to mitigate the risk of triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
