Vulnerability · Published Aug 28, 2025 · Assigned by GitHub_M
CVE-2025-58058github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives
Medium 5.3
In plain English
A medium-severity resource allocation without limits in xz from ulikunitz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-ulikunitz-xz | no fix listed | DEBIAN-CVE-2025-58058 |
| Debian:13 | golang-github-ulikunitz-xz | no fix listed | DEBIAN-CVE-2025-58058 |
| Debian:14 | golang-github-ulikunitz-xz | 0.5.15-1 | DEBIAN-CVE-2025-58058 |
| Go | github.com/ulikunitz/xz | 0.5.15 | GHSA-jc7w-c686-c4v9 |
| Go | github.com/ulikunitz/xz | 0.5.15 | GO-2025-3922 |
| Ubuntu:22.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2025-58058 |
| Ubuntu:24.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2025-58058 |
| Ubuntu:25.10 | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2025-58058 |
| Ubuntu:26.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2025-58058 |
| Ubuntu:26.10 | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2025-58058 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L