The vulnerability (CVE-2025-58058) affects the golang github.com/ulikunitz/xz package integrated in the multicluster engine for Kubernetes versions 2.8.0 through 2.8.8. The issue arises because the LZMA header lacks a magic number or checksum to detect extraneous data prepended to the stream. When such data is present, the package allocates the full decoding buffer prematurely, resulting in a memory leak. Although the problem is detected later in the stream reading process, the memory allocation has already occurred. This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-426. Red Hat has not released a patch or fix for this issue as of the advisory date.

The vulnerability can cause increased memory consumption leading to denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity reported. The issue affects availability by potentially exhausting system memory when processing crafted LZMA streams. No known exploits in the wild have been reported.

No official fix or patch is currently available for this vulnerability. Red Hat states that available mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates. Until a fix is released, consider limiting exposure to untrusted LZMA-encoded data streams in affected components.