id: GO-2021-0103
modules:
    - module: github.com/holiman/uint256
      versions:
        - introduced: 0.1.0
          fixed: 1.1.1
      vulnerable_at: 1.1.0
      packages:
        - package: github.com/holiman/uint256
          symbols:
            - udivrem
          derived_symbols:
            - Int.AddMod
            - Int.Div
            - Int.Mod
            - Int.MulMod
            - Int.SDiv
            - Int.SMod
summary: Denial of service in github.com/holiman/uint256
description: |-
    Due to improper bounds checking, certain mathematical operations can cause a
    panic via an out of bounds read. If this package is used to process untrusted
    user inputs, this may be used as a vector for a denial of service attack.
published: 2021-07-28T18:08:05Z
cves:
    - CVE-2020-26242
ghsas:
    - GHSA-jm5c-rv3w-w83m
credits:
    - Dima Stebaev
references:
    - fix: https://github.com/holiman/uint256/pull/80
    - fix: https://github.com/holiman/uint256/commit/6785da6e3eea403260a5760029e722aa4ff1716d