CVE-2025-58058 github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives
An attacker can cause excessive memory consumption and potential denial of service by providing corrupted LZMA archives to the Go xz library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58058?
CVE-2025-58058 is a medium-severity denial of service vulnerability in ulikunitz xz, published on 28 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.
Weakness: CWE-770
Which versions are affected by CVE-2025-58058?
3 open source packages ship an affected version, including github.com/ulikunitz/xz.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ulikunitz/xz Go | All versions | 0.5.15 |
github.com/ulikunitz/xz Go | All versions | 0.5.15 |
github.com/ulikunitz/xz Go | All versions | 0.5.15 |
Linux distribution packages (9)
warewulf4 SUSE:Linux Enterprise Module for HPC 15 SP6 | All versions | 4.6.4-150500.6.37.1 |
warewulf4 SUSE:Linux Enterprise Module for HPC 15 SP7 | All versions | 4.6.4-150500.6.37.1 |
warewulf4 openSUSE:Leap 15.6 | All versions | 4.6.4-150500.6.37.1 |
warewulf4 openSUSE:Leap 16.0 | All versions | 4.6.4-bp160.1.1 |
regclient openSUSE:Tumbleweed | All versions | 0.9.2-1.1 |
sbctl openSUSE:Tumbleweed | All versions | 0.17-2.1 |
tailscale openSUSE:Tumbleweed | All versions | 1.86.5-1.1 |
trivy openSUSE:Tumbleweed | All versions | 0.66.0-1.1 |
warewulf4 openSUSE:Tumbleweed | All versions | 4.6.4-1.1 |
How do I fix CVE-2025-58058?
Upgrade github.com/ulikunitz/xz to 0.5.15 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58058 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58058 exists.
Sources
Also known as AZL-66713, AZL-66716, AZL-66720, AZL-66723, AZL-66725, AZL-66728 and 60 more.