CVE-2025-58058: ulikunitz xz · Unthrottled Resource Allocation
Affects ulikunitz xzSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : upgrade to 0.5.14 when convenient.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.5.14
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 28 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade ulikunitz xz to 0.5.14.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ulikunitz xz | Affected
| Fixed in
|
AI-suggested
- Upgrade: Immediately update the ulikunitz xz package to version 0.5.14 or later, where the vulnerability is patched.
- Input Validation: Implement strict validation and sanitization of all incoming compressed files, especially those from untrusted sources, to detect and reject malformed or suspicious xz streams before processing.
- Resource Limits: Configure memory usage limits and timeouts on processes handling decompression to prevent excessive resource consumption from malformed inputs.
- Monitoring and Alerting: Deploy monitoring to detect abnormal memory usage or crashes in services handling xz files, enabling rapid response to potential exploitation attempts.
- Dependency Auditing: Conduct thorough audits of software dependencies and container images to identify and remediate vulnerable versions of the xz package.
- Isolation: Run decompression operations in isolated environments or sandboxes to contain potential DoS impacts and prevent cascading failures in critical systems.
Description
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.