Every CVE Search/ Get API key

CVE-2024-3094

Xz: malicious code in distributed source

10.0 CriticalPublic exploitFix available

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

90.9%Up 90.9 points since Mar 30, 2024
90%50%10%1%

What each source reports

CVE List Score used 10.0

Xz: malicious code in distributed source

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-506
Updated
2026-11-04
EUVDEUVD-2024-31700 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
EUVD-2024-31700
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-04
GitHub AdvisoriesGHSA-rxwq-x6h5-x525 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The...

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.

Record
GHSA-rxwq-x6h5-x525
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-506
Updated
2026-11-02
NVD 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-506
Updated
2026-11-04
OSVALPINE-CVE-2024-3094 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
ALPINE-CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2024-3094 10.0
Record
BELL-CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV 10.0

Xz: malicious code in distributed source

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-506
Updated
2026-11-05
OSVDEBIAN-CVE-2024-3094 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
DEBIAN-CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-05
OSVJLSEC-2026-62 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
JLSEC-2026-62
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-3094 10.0

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Record
UBUNTU-CVE-2024-3094
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:14017-1 No score

liblzma5-32bit-5.6.2-1.1 on GA media

These are all security issues fixed in the liblzma5-32bit-5.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14017-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lighttpd
Alpine:v3.15
 before 1.4.76-r0
1.4.76-r0
lighttpd
Alpine:v3.16
 before 1.4.76-r0
1.4.76-r0
lighttpd
Alpine:v3.17
 before 1.4.76-r0
1.4.76-r0
lighttpd
Alpine:v3.18
 before 1.4.76-r0
1.4.76-r0
xz
Alpine:v3.20
 before 5.6.1-r2
5.6.1-r2
xz
Alpine:v3.21
 before 5.6.1-r2
5.6.1-r2
xz
Alpine:v3.22
 before 5.6.1-r2
5.6.1-r2
xz
Alpine:v3.23
 before 5.6.1-r2
5.6.1-r2
xz
Alpine:v3.24
 before 5.6.1-r2
5.6.1-r2
xz
Alpaquita:23
 5.2.8-r0 up to 5.2.9_p525-r0
5.2.9_p525-r0
Show 5 moreShow less
Affected packages
PackageAffectedFixed
xz
BellSoft Hardened Containers:23
 5.2.8-r0 up to 5.2.9_p525-r0
5.2.9_p525-r0
xz-utils
Debian:13
 before 5.6.1+really5.4.5-1
5.6.1+really5.4.5-1
xz-utils
Debian:14
 before 5.6.1+really5.4.5-1
5.6.1+really5.4.5-1
XZ_jll
Julia
 5.6.0+0 up to 5.6.3+0
5.6.3+0
xz
openSUSE:Tumbleweed
 before 5.6.2-1.1
5.6.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubFabioBaroni/CVE-2024-3094-checker2024-03-29
PoC in GitHubFractal-Tess/CVE-2024-30942024-03-29
PoC in GitHubHackerHermanos/CVE-2024-3094_xz_check2024-03-29
PoC in GitHubOpensourceICTSolutions/xz_utils-CVE-2024-30942024-03-29
PoC in GitHubbioless/xz_cve-2024-3094_detection2024-03-29
PoC in GitHubbyinarie/CVE-2024-3094-info2024-03-29
PoC in GitHublypd0/CVE-2024-3094-Vulnerabity-Checker2024-03-29
PoC in GitHubHorizon-Software-Development/CVE-2024-30942024-03-30
PoC in GitHubashwani95/CVE-2024-30942024-03-30
PoC in GitHubbrinhosa/CVE-2024-3094-One-Liner2024-03-30
Show 15 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubemirkmo/xz-backdoor-github2024-03-30
PoC in GitHubgensecaihq/CVE-2024-3094-Vulnerability-Checker-Fixer2024-03-30
PoC in GitHubharekrishnarai/xz-utils-vuln-checker2024-03-30
PoC in GitHubhazemkya/CVE-2024-3094-checker2024-03-30
PoC in GitHublockness-Ko/xz-vulnerable-honeypot2024-03-30
PoC in GitHubteyhouse/CVE-2024-30942024-03-30
PoC in GitHubwgetnz/CVE-2024-3094-check2024-03-30
PoC in GitHubMustafa1986/CVE-2024-30942024-03-31
PoC in GitHubSimplifi-ED/CVE-2024-3094-patcher2024-03-31
PoC in GitHubYuma-Tsushima07/CVE-2024-30942024-03-31
PoC in GitHubisuruwa/CVE-2024-30942024-03-31
PoC in GitHubjfrog/cve-2024-3094-tools2024-03-31
PoC in GitHubspidygal/CVE-2024-3094-Nmap-NSE-script2024-03-31
PoC in GitHub0xlane/xz-cve-2024-30942024-04-01
PoC in GitHubMrBUGLF/XZ-Utils_CVE-2024-30942024-04-01

History

History
RecordedChangedSources
exploits_more, factsPoC in GitHub
exploits, exploits_more
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-3094 is a critical vulnerability (CVSS 10.0) in Tukaani Xz, published March 29, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.9%, the 99th percentile. Fixed in lighttpd 1.4.76-r0.

References

Show 58 moreShow less
This page doesn't list everything

The full exploit list has 64 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open