« Volver al listado

CVE-2025-58058

Estado: AplazadaMedia (5.3)—

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

XZ — XZAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58058",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58058",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-29T13:22:52.507752Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ulikunitz",
          "product": "xz",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.5.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-28T22:15:32.577",
  "references": [
    {
      "url": "https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14."
    },
    {
      "lang": "es",
      "value": "xz es un paquete puro de golang para leer y escribir archivos comprimidos xz. Antes de la versión 0.5.14, es posible colocar datos delante de un flujo de bytes codificado en LZMA sin detectar la situación al leer la cabecera. Esto puede llevar a un mayor consumo de memoria porque la implementación actual asigna el búfer de decodificación completo directamente después de leer la cabecera. La cabecera LZMA no incluye un número mágico ni tiene una suma de verificación para detectar tal problema según la especificación. Tenga en cuenta que el código reconoce el problema más tarde al leer el flujo, pero en este momento la asignación de memoria ya se ha realizado. Este problema ha sido parcheado en la versión 0.5.14."
    }
  ],
  "lastModified": "2026-09-26T00:10:00.127",
  "sourceIdentifier": "security-advisories@github.com"
}