{"id":"EUVD-2025-26149","revision":"d367d89cad9549e9b4d7d18df8d2f9c2","records":[{"revision":"d367d89cad9549e9b4d7d18df8d2f9c2","observedAt":"2026-11-09T03:12:56.131+00:00","statement":{"source":"euvd","id":"EUVD-2025-26149","aliases":["CVE-2025-58058","GHSA-jc7w-c686-c4v9"],"title":"xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to …","description":"xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9","https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26149","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 28, 2025, 9:54:05 PM","dateUpdated":"Aug 29, 2025, 1:23:07 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:03448-1","title":"Security update for warewulf4","vulnerabilityIds":["CVE-2025-58058"]},{"id":"msrc_CVE-2025-58058","title":"github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives","vulnerabilityIds":["CVE-2025-58058"]},{"id":"SUSE-SU-2026:0383-1","title":"Security update for rekor","vulnerabilityIds":["CVE-2025-29923","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15509-1","title":"sbctl-0.17-2.1 on GA media","vulnerabilityIds":["CVE-2025-58058"]},{"id":"RHSA-2026:26254","title":"Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.8","vulnerabilityIds":["CVE-2025-58058","CVE-2026-39883"]},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","vulnerabilityIds":["CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41178","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304"]},{"id":"SUSE-SU-2025:4121-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"openSUSE-SU-2026:21151-1","title":"Security update for warewulf4","vulnerabilityIds":["CVE-2025-58058","CVE-2025-69725","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821"]},{"id":"RHSA-2026:26257","title":"Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.8","vulnerabilityIds":["CVE-2025-58058","CVE-2026-39883"]},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-53547","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190"]},{"id":"openSUSE-SU-2026:11305-1","title":"containerized-data-importer1.65-api-1.65.0-2.1 on GA media","vulnerabilityIds":["CVE-2025-22870","CVE-2025-22872","CVE-2025-58058","CVE-2025-58190","CVE-2026-27136","CVE-2026-33186","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39832","CVE-2026-42508"]},{"id":"openSUSE-SU-2026:20105-1","title":"Security update for sbctl","vulnerabilityIds":["CVE-2025-47911","CVE-2025-58058","CVE-2025-58190"]},{"id":"openSUSE-SU-2025-20073-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15722-1","title":"hauler-1.3.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-11579","CVE-2025-47911","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"openSUSE-SU-2025-20031-1","title":"Security update for warewulf4","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2025-20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:20160-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2024-0406","CVE-2024-45338","CVE-2025-11579","CVE-2025-22872","CVE-2025-46569","CVE-2025-47911","CVE-2025-58058","CVE-2025-58190"]},{"id":"openSUSE-SU-2025:20031-1","title":"Security update for warewulf4","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","vulnerabilityIds":["CVE-2023-45288","CVE-2024-45339","CVE-2025-13465","CVE-2025-22868","CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-24358","CVE-2025-47911","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2025-5889","CVE-2025-64718","CVE-2025-6545","CVE-2025-6547","CVE-2025-7783","CVE-2026-1229","CVE-2026-25128","CVE-2026-25680","CVE-2026-25681","CVE-2026-26278","CVE-2026-26996","CVE-2026-27136","CVE-2026-2739","CVE-2026-27606","CVE-2026-27904","CVE-2026-33036","CVE-2026-33186","CVE-2026-33487","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-42039","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"openSUSE-SU-2025:15631-1","title":"alloy-1.11.2-2.1 on GA media","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15564-1","title":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","vulnerabilityIds":["CVE-2025-4953","CVE-2025-54123","CVE-2025-54376","CVE-2025-58058","CVE-2025-58063","CVE-2025-58157","CVE-2025-58158","CVE-2025-58430","CVE-2025-58437","CVE-2025-58445","CVE-2025-58450","CVE-2025-59358","CVE-2025-59359","CVE-2025-59360","CVE-2025-59361","CVE-2025-7445","CVE-2025-8396","CVE-2025-9072","CVE-2025-9076","CVE-2025-9078","CVE-2025-9084"]},{"id":"openSUSE-SU-2026:20192-1","title":"Security update for tailscale","vulnerabilityIds":["CVE-2025-22869","CVE-2025-58058"]},{"id":"SUSE-SU-2025:21137-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15515-1","title":"regclient-0.9.2-1.1 on GA media","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15537-1","title":"warewulf4-4.6.4-1.1 on GA media","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15542-1","title":"trivy-0.66.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15508-1","title":"rekor-1.4.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-29923","CVE-2025-58058"]},{"id":"RHSA-2026:37387","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-25621","CVE-2024-40635","CVE-2024-45310","CVE-2025-8766","CVE-2025-21613","CVE-2025-21614","CVE-2025-22870","CVE-2025-47911","CVE-2025-52881","CVE-2025-54410","CVE-2025-58058","CVE-2025-64329","CVE-2025-66506","CVE-2026-22772","CVE-2026-23831","CVE-2026-24117","CVE-2026-25680","CVE-2026-25681","CVE-2026-25934","CVE-2026-27136","CVE-2026-27141","CVE-2026-27903","CVE-2026-33540","CVE-2026-33747","CVE-2026-33748","CVE-2026-33814","CVE-2026-34986","CVE-2026-35172","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-39883","CVE-2026-41506","CVE-2026-41567","CVE-2026-41568","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-44740","CVE-2026-45571","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]},{"id":"openSUSE-SU-2025:15503-1","title":"tailscale-1.86.5-1.1 on GA media","vulnerabilityIds":["CVE-2025-58058"]},{"id":"openSUSE-SU-2026:11514-1","title":"containerized-data-importer1.66-api-1.66.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-47911","CVE-2025-58058","CVE-2025-58190","CVE-2026-27136","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39832","CVE-2026-42508","CVE-2026-56852"]},{"id":"openSUSE-SU-2025:20073-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-26149","identifiers":["EUVD-2025-26149","CVE-2025-58058","GHSA-jc7w-c686-c4v9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}