CVE-2025-58058

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

• CWE-770

• https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2
• https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9

Published

Aug 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58052Galette is a membership management web application for non p…8.1
• CVE-2025-58053Galette is a membership management web application for non p…9.8
• CVE-2025-58054Discourse is an open-source community discussion platform. V…5.4
• CVE-2025-58055Discourse is an open-source community discussion platform. I…4.3
• CVE-2025-58056Netty is an asynchronous event-driven network application fr…7.5
• CVE-2025-58057Netty is an asynchronous event-driven network application fr…7.5
• CVE-2025-58059Valtimo is a platform for Business Process Automation. In ve…9.1
• CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling r…8
• CVE-2025-58060OpenPrinting CUPS is an open source printing system for Linu…8
• CVE-2025-58061OpenEBS Local PV RawFile allows dynamic deployment of Statef…5.5
• CVE-2025-58062LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp de…7.3
• CVE-2025-58063CoreDNS is a DNS server that chains plugins. Starting in ver…7.1