HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/hashicorp/go-getter(Go) | 0 | 1.7.0 | N/A |
| github.com/hashicorp/go-getter/v2(Go) | 2.0.0 | 2.2.0 | N/A |
CVSS Metrics
