denial of service in github.com/ulikunitz/xz
Priority LOW 36CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Why it matters now
EPSS 0.01438 73rd percentileScored 2026-11-07
Fix Partial xz (ulikunitz): 0.5.8github.com/ulikunitz/xz (Go): 0.5.8Red Hat: 4 advisoriesRed Hat: 4 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ulikunitz | xz | before 0.5.8 | 0.5.8 | Patch available | CNA |
| — | github.com/ulikunitz/xz (Go) | before 0.5.8 | 0.5.8 | Patch available | GHSA-25xm-hr59-7c27 |
- xz Vendorulikunitz Affected before 0.5.8 Fixed in 0.5.8 Patch available CNA
- github.com/ulikunitz/xz (Go) Vendor— Affected before 0.5.8 Fixed in 0.5.8 Patch available GHSA-25xm-hr59-7c27
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xz_project:xz:*:*:*:*:*:go:*:* | before 0.5.8 | Vulnerable | Xz Project |
- cpe:2.3:a:xz_project:xz:*:*:*:*:*:go:*:* Versions before 0.5.8 Vulnerable ·Xz Project
Remediation
- Fix · CNA xz (ulikunitz) Fixed in 0.5.8
- Fix · GHSA-25xm-hr59-7c27 github.com/ulikunitz/xz (Go) Fixed in 0.5.8 Advisory →
Red Hat 4 advisories
- RHSA-2022:2183 Released 2022-05-11 · Red Hat rating ModerateRelease of containers for OSP 16.2.z director operator tech preview
- Red Hat OpenStack Platform 16.2 rhosp-rhel8-tech-preview/osp-director-operator
- RHSA-2022:1276 Released 2022-04-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.0.9 security update
- OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
- RHSA-2022:0687 Released 2022-02-28 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.0.1 security and bug fix update
- 8Base-OADP-1.0 oadp/oadp-registry-rhel8, oadp/oadp-velero-plugin-rhel8
Show 1 more Red Hat advisories
- RHSA-2021:2920 Released 2021-07-28 · Red Hat rating ModerateOpenShift Virtualization 4.8.0 Images
- CNV 4.8 for RHEL 8 container-native-virtualization/vm-import-operator-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| 8Base-OADP-1.0 | Fixed | RHSA-2022:0687 |
| CNV 4.8 for RHEL 8 | Fixed | RHSA-2021:2920 |
| OpenShift Service Mesh 2.0 | Fixed | RHSA-2022:1276 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:2183 |
Not affected: 8 products
- 8Base-OADP-1.0
- Migration Toolkit for Containers
- OpenShift Service Mesh 2.0
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenShift Virtualization 2
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29482
- 2026-10-03 Alias added: GHSA-25xm-hr59-7c27
References
More ulikunitz vulnerabilities
- TI-2025-35901 github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-29482 · CVE Program
- CVE-2021-29482 · NVD
- FIRST EPSS
- GHSA-25xm-hr59-7c27 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-29482 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences