Denial of Service Vulnerability in XZ Product by Tukaani

CVE-2020-22916

What is CVE-2020-22916?

A vulnerability in XZ version 5.2.5 allows attackers to potentially cause a denial of service through the decompression of specially crafted files. When these files are processed, they may result in a substantial increase in output size, leading to resource exhaustion. The vendor has disputed claims related to endless output and highlights that while the decompression process produces a larger file, the implications for service disruption warrant further analysis.

References