LZMA Memory Allocation Issue in xz by Ulikunitz

CVE-2025-58058

What is CVE-2025-58058?

The xz library, a Golang package for managing xz-compressed files, has a vulnerability in versions before 0.5.14 that allows the insertion of data at the start of an LZMA-encoded byte stream without appropriate detection during header reads. This oversight can result in excessive memory usage as the implementation pre-allocates a decoding buffer upon header reading, despite potential issues not being recognized until stream reading later on. The absence of a magic number or checksum in the LZMA header contributes to this problem. The vulnerability has been addressed in version 0.5.14.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References