CVE-2024-3094

CVSS: 10.0v3.1CriticalModified

AliasesALPINE-CVE-2024-3094UBUNTU-CVE-2024-3094DEBIAN-CVE-2024-3094CGA-42f2-4jw2-vjhpCGA-92fm-f345-22r5CGA-p56r-v7qh-5r94CGA-qwh4-287x-98f3openSUSE-SU-2024:14017-1

Published 2024-03-29Last modified 2026-08-04

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

10.0/10

010

Critical · v3.1 (cve.org)

EPSS score

90.46%

0%100%

Critical · +4.49 pp in 30 days

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 3

CGA-3R9W-5X9C-PWR7 CGA-8CRC-R3GG-JR73 CGA-XP9G-W4GQ-2V78

Timeline

2024-03-29
PublishedVulnerability first disclosed.
2026-08-04
Last modifiedVulnerability information updated.

Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

CVSS metrics

7 scores · 7 sources · 1 version

v3.110.0

EPSS trend

Probability

90.46%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+4.49 pp

From 85.97% on 2026-09-14

2026-09-142026-10-14

EPSS score

90.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-506Embedded Malicious CodeThe product contains code that appears to be malicious in nature.

Affected systems

Alpine2 products

lighttpd< 1.4.76-r0
xz< 5.6.1-r2

Chainguard2 products

opensshAll versions (No fix recorded)
xzAll versions (No fix recorded)

Wolfi2 products

opensshAll versions (No fix recorded)
xzAll versions (No fix recorded)

Debian1 product

xz-utils< 5.6.1+really5.4.5-1

Opensuse1 product

xz&distro=openSUSE Tumbleweed< 5.6.2-1.1

Tukaani1 product

xz5.6.0 | 5.6.1

Ubuntu1 product

xz-utils< 5.2.4-1ubuntu1.1 | < 5.2.5-2ubuntu1 | < 5.4.5-0.3

7 vendors · 10 products

References

63 links

access.redhat.com/security/cve/CVE-2024-3094VDB EntryX Refsource REDHATAdvisoryVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=2272210Issue TrackingX Refsource REDHATREPORTVendor Advisory
www.openwall.com/lists/oss-security/2024/03/29/4REPORTWEBMailing List
www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-usersARTICLEVendor Advisory
www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-imagesARTICLE
ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/X TransferredWEB
arstechnica.com/security/…X TransferredWEBThird Party Advisory
aws.amazon.com/security/security-bulletins/AWS-2024-002/X TransferredWEBThird Party Advisory
blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xzX TransferredARTICLE
boehs.org/node/everything-i-know-about-the-xz-backdoorX TransferredWEBThird Party Advisory

Show all 63 references

bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024X TransferredWEBMailing ListVendor Advisory
bugs.gentoo.org/928134X TransferredWEBIssue TrackingThird Party Advisory
bugzilla.suse.com/show_bug.cgi?id=1222124X TransferredREPORTIssue TrackingThird Party Advisory
discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405X TransferredWEBThird Party Advisory
gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27X TransferredWEBThird Party Advisory
github.com/advisories/GHSA-rxwq-x6h5-x525X TransferredAdvisoryThird Party Advisory
github.com/amlweems/xzbotX TransferredPACKAGE
github.com/karcherm/xz-malwareX TransferredPACKAGEThird Party Advisory
gynvael.coldwind.pl?lang=en&id=782X TransferredWEBTechnical DescriptionThird Party Advisory
lists.debian.org/debian-security-announce/2024/msg00057.htmlX TransferredWEBMailing ListThird Party Advisory
lists.freebsd.org/archives/freebsd-security/2024-March/000248.htmlX TransferredWEBThird Party Advisory
lwn.net/Articles/967180/X TransferredWEBIssue TrackingThird Party Advisory
news.ycombinator.com/item?id=39865810X TransferredWEBIssue TrackingThird Party Advisory
news.ycombinator.com/item?id=39877267X TransferredWEBIssue Tracking
news.ycombinator.com/item?id=39895344X TransferredWEB
openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/X TransferredARTICLEThird Party Advisory
research.swtch.com/xz-scriptX TransferredWEB
research.swtch.com/xz-timelineX TransferredWEB
security-tracker.debian.org/tracker/CVE-2024-3094X TransferredAdvisoryWEBThird Party Advisory
security.alpinelinux.org/vuln/CVE-2024-3094X TransferredAdvisoryWEBThird Party Advisory
security.archlinux.org/CVE-2024-3094X TransferredWEBThird Party Advisory
security.netapp.com/advisory/ntap-20240402-0001/X TransferredAdvisory
tukaani.org/xz-backdoor/X TransferredWEBIssue TrackingVendor Advisory
twitter.com/LetsDefendIO/status/1774804387417751958X TransferredWEBThird Party Advisory
twitter.com/debian/status/1774219194638409898X TransferredWEBPress/Media Coverage
twitter.com/infosecb/status/1774595540233167206X TransferredWEBPress/Media Coverage
twitter.com/infosecb/status/1774597228864139400X TransferredWEBPress/Media Coverage
ubuntu.com/security/CVE-2024-3094X TransferredREPORTWEBThird Party Advisory
www.cisa.gov/news-events/…X TransferredWEBThird Party AdvisoryUS Government Resource
www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utilsX TransferredWEBThird Party Advisory
www.kali.org/blog/about-the-xz-backdoor/X TransferredARTICLE
www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utilsX TransferredARTICLEThird Party Advisory
www.theregister.com/2024/03/29/malicious_backdoor_xz/X TransferredWEBPress/Media Coverage
www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094X TransferredWEB
xeiaso.net/notes/2024/xz-vuln/X TransferredWEBThird Party Advisory
www.openwall.com/lists/oss-security/2024/03/30/12X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/30/27X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/29/12X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/29/10X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/30/36X TransferredWEB
www.openwall.com/lists/oss-security/2024/04/16/5X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/29/8X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/30/5X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/29/5X TransferredWEB
www.openwall.com/lists/oss-security/2024/03/29/4X TransferredWEB
discourse.ubuntu.com/t/xz-liblzma-security-update/43714REPORT
www.cve.org/CVERecord?id=CVE-2024-3094REPORT
access.redhat.com/downloads/content/package-browser/WEB
access.redhat.com/jbossnetwork/restricted/listSoftware.htmlWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3094.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-3094Advisory
github.com/tukaani-project/xzPACKAGE
www.suse.com/security/cve/CVE-2024-3094WEB