CVE-2020-16845: 
Go vulnerability analysis and mitigation

CVE-2020-16845 affects Go programming language versions before 1.13.15 and 14.x before 1.14.7. The vulnerability was discovered in August 2020 and affects the encoding/binary package, specifically the ReadUvarint and ReadVarint functions (NVD).

The vulnerability exists in the encoding/binary package where certain invalid inputs to the ReadUvarint and ReadVarint functions could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

A successful exploitation of this vulnerability could lead to a Denial of Service (DoS) condition by causing an infinite read loop when processing invalid inputs (NetApp Advisory).

The vulnerability is remotely exploitable without requiring authentication. An attacker can trigger the vulnerability by providing specially crafted invalid inputs to the affected functions (NVD).

The vulnerability has been fixed in Go versions 1.13.15 and 1.14.7. Users should upgrade to these or later versions. The fix ensures that the functions terminate if more than 10 bytes of input have been read (Fedora Update).