Resource exhaustion in Ulikunitz Xz
CVE-2025-58058
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.
EPSS: 0.004 (31.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Ulikunitz Xz — versions < 0.5.14
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-58058?
- CVE-2025-58058 is a medium-severity vulnerability in Ulikunitz Xz, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2025-08-28.
- How severe is CVE-2025-58058?
- Medium severity. CVSS v3 base score is 5.3 out of 10.