Vulnerabilities

TI-2026-26987 CVE-2026-34743

XZ Utils: Buffer overflow in lzma_index_append()

LOW 16

XZ Utils provide a general-purpose data-compression library plus command-line tools.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00534 Published 2026-04-02 Partial fix · 5.8.3 CWE-122

TI-2024-02898 CVE-2024-3094 · GHSA-rxwq-x6h5-x525

Xz: malicious code in distributed source

CRITICAL 92

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.909 Published 2024-03-29 No fix listed CWE-506

TI-2020-14422 CVE-2020-22916 · GHSA-8rm5-v9qv-hvcc

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via…

LOW 24

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00249 Published 2023-08-22 No fix listed

TI-2022-01156 CVE-2022-1271 · GHSA-jrpw-543v-8r62

Improper input validation in gzip, xz-utils

MEDIUM 49

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05549 Published 2022-08-31 Partial fix CWE-179

TI-2015-03402 CVE-2015-4035 · GHSA-mf33-8p24-6h53

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process…

LOW 36

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted fi…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0099 Published 2017-07-25 Will not fix CWE-20