CVE-2025-58058: github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

Deferred

AliasesSUSE-SU-2025:03448-1UBUNTU-CVE-2025-58058DEBIAN-CVE-2025-58058+278 more

Published 28-08-2025Last modified 29-08-2025

Vulnerability summary

CVE-2025-58058 is a medium (CVSS 5.3) vulnerability in ulikunitz xz. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.6% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 92

OPENSUSE-SU-2025:15508-1 OPENSUSE-SU-2025:15564-1 OPENSUSE-SU-2025:15631-1 OPENSUSE-SU-2025:15722-1 OPENSUSE-SU-2025:20073-1 OPENSUSE-SU-2025:20117-1+86 more

Timeline

28-08-2025
PublishedVulnerability first disclosed.
29-08-2025
Last modifiedVulnerability information updated.

Description

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard139 products

atlantis-fips< 0.35.1-r3
cg< 0_git20250819-r1
chainctl< 0.2.135-r0
cloudbeat-9.0< 9.0.8-r30
cloudbeat-fips-8.17< 8.17.10-r32

cloudbeat-fips-9.0< 9.0.8-r34
conftest-fips< 0.62.0-r5
crossplane-provider-terraform< 1.0.0-r1
crossplane-provider-terraform-compat< 1.0.0-r1
docker-credential-cgr< 0.2.135-r0
drone< 3.3.0-r6
drone-fips< 3.3.0-r6
envoy-gateway< 1.5.0-r3
envoy-gateway-compat< 1.5.0-r3
envoy-gateway-egctl< 1.5.0-r3
envoy-gateway-fips< 1.5.0-r2
envoy-gateway-fips-egctl< 1.5.0-r2
filebrowser< 2.42.5-r1
filebrowser-compat< 2.42.5-r1
gitea-fips< 1.24.5-r2
gitea-fips-compat< 1.24.5-r2
gitleaks< 8.28.0-r2
gitness< 3.3.0-r23
google-osconfig-agent< 20250520.00-r4
gotenberg< 8.22.0-r1
gptscript< 0.9.5-r15
grafana-alloy< 1.10.2-r3
grafana-alloy-fips< 1.10.2-r3
grype-db< 0.39.0-r1
grype-db-manager< 0.39.0-r1
grype-fips< 0.99.0-r1
guac< 1.0.0-r5
guaccsub< 1.0.0-r5
guacgql< 1.0.0-r5
guacingest< 1.0.0-r5
guacone< 1.0.0-r5
k8s-image-swapper< 1.6.5-r2
k8s-image-swapper-fips< 1.6.5-r2
k9s< 0.50.9-r8
k9s-fips< 0.50.9-r7
kubescape-operator< 0.2.103-r1
kubescape-operator-fips< 0.2.103-r0
mattermost-10.12< 10.12.0-r1
mattermost-10.12-compat< 10.12.0-r1
mattermost-fips-10.10< 10.10.2-r2
mattermost-fips-10.10-compat< 10.10.2-r2
mattermost-fips-10.11< 10.11.2-r2
mattermost-fips-10.11-compat< 10.11.2-r2
mattermost-fips-10.12< 10.12.0-r1
mattermost-fips-10.12-compat< 10.12.0-r1
mattermost-fips-10.5< 10.5.10-r1
mattermost-fips-10.5-compat< 10.5.10-r1
mattermost-fips-10.9< 10.9.5-r1
mattermost-fips-10.9-compat< 10.9.5-r1
nsc< 2.11.1-r1
nsc-fips< 2.11.1-r1
nuclei< 3.4.10-r1
opentofu-1.10< 1.10.5-r4
opentofu-1.10-compat< 1.10.5-r4
opentofu-1.10-local-provider-config< 1.10.5-r4
opentofu-1.8< 1.8.11-r4
opentofu-1.8-compat< 1.8.11-r4
opentofu-1.8-local-provider-config< 1.8.11-r4
opentofu-1.9< 1.9.3-r4
opentofu-1.9-compat< 1.9.3-r4
opentofu-1.9-local-provider-config< 1.9.3-r4
opentofu-fips-1.10< 1.10.5-r4
opentofu-fips-1.8< 1.8.11-r4
opentofu-fips-1.9< 1.9.3-r4
packer< 1.14.1-r2
packer-fips< 1.14.1-r2
podman< 5.6.0-r1
podman-doc< 5.6.0-r1
prometheus-podman-exporter< 1.18.0-r1
prometheus-podman-exporter-fips< 1.18.0-r1
rancher-fleet< 0.13.1-r1
rancher-fleet-agent< 0.13.1-r1
rancher-fleet-agent-fips< 0.13.1-r1
rancher-fleet-cli< 0.13.1-r1
rancher-fleet-cli-fips< 0.13.1-r1
rancher-fleet-controller< 0.13.1-r1
rancher-fleet-controller-fips< 0.13.1-r1
rancher-fleet-fips< 0.13.1-r1
rancher-fleet-termination-log< 0.13.1-r1
regclient-fips< 0.9.2-r0
regclient-regbot-fips< 0.9.2-r0
regclient-regctl-fips< 0.9.2-r0
regclient-regsync-fips< 0.9.2-r0
skopeo-fips< 1.20.0-r2
steampipe< 2.1.0-r6
syft-fips< 1.32.0-r1
terraform< 1.5.7-r32
terraform-1.10< 1.10.5-r13
terraform-1.10-compat< 1.10.5-r13
terraform-1.10-local-provider-config< 1.10.5-r13
terraform-1.11< 1.11.4-r8
terraform-1.11-compat< 1.11.4-r8
terraform-1.11-local-provider-config< 1.11.4-r8
terraform-1.12< 1.12.2-r5
terraform-1.12-compat< 1.12.2-r5
terraform-1.12-local-provider-config< 1.12.2-r5
terraform-1.13< 1.13.1-r1
terraform-1.13-compat< 1.13.1-r1
terraform-1.13-local-provider-config< 1.13.1-r1
terraform-1.9< 1.9.8-r18
terraform-1.9-compat< 1.9.8-r18
terraform-1.9-local-provider-config< 1.9.8-r18
terraform-compat< 1.5.7-r32
terraform-fips-1.11< 1.11.4-r8
terraform-fips-1.11-compat< 1.11.4-r8
terraform-fips-1.11-local-provider-config< 1.11.4-r8
terraform-fips-1.13< 1.13.1-r1
terraform-fips-1.13-compat< 1.13.1-r1
terraform-fips-1.13-local-provider-config< 1.13.1-r1
terraform-local-provider-config< 1.5.7-r32
terragrunt< 0.86.2-r1
terragrunt-docs< 0.86.2-r1
tflint< 0.58.1-r5
tflint-compat< 0.58.1-r5
trivy< 0.65.0-r5
trivy-fips< 0.65.0-r5
trivy-operator< 0.28.0-r3
trivy-operator-fips< 0.28.0-r5
trufflehog< 3.90.5-r1
trufflehog-fips< 3.90.5-r1
undock< 0.10.0-r4
vault-1.16< 1.16.3-r24
vault-1.16-compat< 1.16.3-r24
vcluster< 0.27.0-r1
vcluster-cli< 0.27.0-r1
vcluster-cli-fips< 0.35.0-r1
vcluster-fips< 0.35.0-r1
vcluster-syncer< 0.27.0-r1
vcluster-syncer-fips< 0.35.0-r1
xeol< 0.10.8-r13
xeol-compat< 0.10.8-r13
xeol-fips< 0.10.8-r13
zarf< 0.61.0-r1
zot< 2.1.7-r4

Show all 139

Wolfi46 products

envoy-gateway< 1.5.0-r3
envoy-gateway-compat< 1.5.0-r3
envoy-gateway-egctl< 1.5.0-r3
filebrowser< 2.42.5-r1
filebrowser-compat< 2.42.5-r1

Show all 46

Opensuse7 products

regclient&distro=openSUSE Tumbleweed< 0.9.2-1.1
sbctl&distro=openSUSE Tumbleweed< 0.17-2.1
tailscale&distro=openSUSE Tumbleweed< 1.86.5-1.1
trivy&distro=openSUSE Tumbleweed< 0.66.0-1.1
warewulf4&distro=openSUSE Leap 15.6< 4.6.4-150500.6.37.1

Show all 7

Suse2 products

warewulf4&distro=SUSE Linux Enterprise Module for HPC 15 SP6< 4.6.4-150500.6.37.1
warewulf4&distro=SUSE Linux Enterprise Module for HPC 15 SP7< 4.6.4-150500.6.37.1

Debian1 product

golang-github-ulikunitz-xzAll versions (No fix recorded) | < 0.5.15-1

Github.com/ulikunitz1 product

xz< 0.5.15

Ubuntu1 product

golang-github-ulikunitz-xzAll versions (No fix recorded)

Ulikunitz1 product

xz< 0.5.14

8 vendors · 198 products

References

15 links

github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9X Refsource CONFIRMREPORTAdvisoryWEB
github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2X Refsource MISCREPORTFIXWEB
www.suse.com/support/update/announcement/2025/suse-su-202503448-1/Advisory
bugzilla.suse.com/1227465REPORT
bugzilla.suse.com/1227686REPORT
bugzilla.suse.com/1246082REPORT
bugzilla.suse.com/1248768REPORT
bugzilla.suse.com/1248906REPORT
www.suse.com/security/cve/CVE-2025-58058WEB
ubuntu.com/security/CVE-2025-58058REPORT

Show all 15 references

www.cve.org/CVERecord?id=CVE-2025-58058REPORT
security-tracker.debian.org/tracker/CVE-2025-58058Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58058.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-58058AdvisoryOval
github.com/ulikunitz/xzPACKAGE