An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HTukaani Xz
APPTukaani5.2.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoS
References
Related vulnerabilities
CVE-2024-3094CRITICAL10.0PL ✓ten sam produkt
Złośliwy kod w bibliotece xz/liblzma – backdoor w łańcuchu dostaw
CVE-2022-1271HIGH8.8ten sam produkt
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the atta...
CVE-2015-4035HIGH7.8ten sam produkt
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing s...
CVE-2026-34743LOW1.7ten sam produkt
XZ Utils to biblioteka do kompresji danych ogólnego przeznaczenia wraz z narzędziami wiersza poleceń. W wersja...