{"id":"CVE-2024-3094","aliases":["ALPINE-CVE-2024-3094","BELL-CVE-2024-3094","DEBIAN-CVE-2024-3094","EUVD-2024-31700","GHSA-rxwq-x6h5-x525","JLSEC-2026-62","UBUNTU-CVE-2024-3094","openSUSE-SU-2024:14017-1"],"status":"published","title":"Xz: malicious code in distributed source","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.909,"percentile":0.99809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-506"],"published":"2024-03-29T16:51:12Z","modified":"2026-11-02T12:02:23Z","exploits":[{"source":"pocgithub","id":"FabioBaroni/CVE-2024-3094-checker","title":"FabioBaroni/CVE-2024-3094-checker","date":"2024-03-29","url":"https://github.com/FabioBaroni/CVE-2024-3094-checker"},{"source":"pocgithub","id":"Fractal-Tess/CVE-2024-3094","title":"Fractal-Tess/CVE-2024-3094","date":"2024-03-29","url":"https://github.com/Fractal-Tess/CVE-2024-3094"},{"source":"pocgithub","id":"HackerHermanos/CVE-2024-3094_xz_check","title":"HackerHermanos/CVE-2024-3094_xz_check","date":"2024-03-29","url":"https://github.com/HackerHermanos/CVE-2024-3094_xz_check"},{"source":"pocgithub","id":"OpensourceICTSolutions/xz_utils-CVE-2024-3094","title":"OpensourceICTSolutions/xz_utils-CVE-2024-3094","date":"2024-03-29","url":"https://github.com/OpensourceICTSolutions/xz_utils-CVE-2024-3094"},{"source":"pocgithub","id":"bioless/xz_cve-2024-3094_detection","title":"bioless/xz_cve-2024-3094_detection","date":"2024-03-29","url":"https://github.com/bioless/xz_cve-2024-3094_detection"},{"source":"pocgithub","id":"byinarie/CVE-2024-3094-info","title":"byinarie/CVE-2024-3094-info","date":"2024-03-29","url":"https://github.com/byinarie/CVE-2024-3094-info"},{"source":"pocgithub","id":"lypd0/CVE-2024-3094-Vulnerabity-Checker","title":"lypd0/CVE-2024-3094-Vulnerabity-Checker","date":"2024-03-29","url":"https://github.com/lypd0/CVE-2024-3094-Vulnerabity-Checker"},{"source":"pocgithub","id":"Horizon-Software-Development/CVE-2024-3094","title":"Horizon-Software-Development/CVE-2024-3094","date":"2024-03-30","url":"https://github.com/Horizon-Software-Development/CVE-2024-3094"},{"source":"pocgithub","id":"ashwani95/CVE-2024-3094","title":"ashwani95/CVE-2024-3094","date":"2024-03-30","url":"https://github.com/ashwani95/CVE-2024-3094"},{"source":"pocgithub","id":"brinhosa/CVE-2024-3094-One-Liner","title":"brinhosa/CVE-2024-3094-One-Liner","date":"2024-03-30","url":"https://github.com/brinhosa/CVE-2024-3094-One-Liner"},{"source":"pocgithub","id":"emirkmo/xz-backdoor-github","title":"emirkmo/xz-backdoor-github","date":"2024-03-30","url":"https://github.com/emirkmo/xz-backdoor-github"},{"source":"pocgithub","id":"gensecaihq/CVE-2024-3094-Vulnerability-Checker-Fixer","title":"gensecaihq/CVE-2024-3094-Vulnerability-Checker-Fixer","date":"2024-03-30","url":"https://github.com/gensecaihq/CVE-2024-3094-Vulnerability-Checker-Fixer"},{"source":"pocgithub","id":"harekrishnarai/xz-utils-vuln-checker","title":"harekrishnarai/xz-utils-vuln-checker","date":"2024-03-30","url":"https://github.com/harekrishnarai/xz-utils-vuln-checker"},{"source":"pocgithub","id":"hazemkya/CVE-2024-3094-checker","title":"hazemkya/CVE-2024-3094-checker","date":"2024-03-30","url":"https://github.com/hazemkya/CVE-2024-3094-checker"},{"source":"pocgithub","id":"lockness-Ko/xz-vulnerable-honeypot","title":"lockness-Ko/xz-vulnerable-honeypot","date":"2024-03-30","url":"https://github.com/lockness-Ko/xz-vulnerable-honeypot"},{"source":"pocgithub","id":"teyhouse/CVE-2024-3094","title":"teyhouse/CVE-2024-3094","date":"2024-03-30","url":"https://github.com/teyhouse/CVE-2024-3094"},{"source":"pocgithub","id":"wgetnz/CVE-2024-3094-check","title":"wgetnz/CVE-2024-3094-check","date":"2024-03-30","url":"https://github.com/wgetnz/CVE-2024-3094-check"},{"source":"pocgithub","id":"Mustafa1986/CVE-2024-3094","title":"Mustafa1986/CVE-2024-3094","date":"2024-03-31","url":"https://github.com/Mustafa1986/CVE-2024-3094"},{"source":"pocgithub","id":"Simplifi-ED/CVE-2024-3094-patcher","title":"Simplifi-ED/CVE-2024-3094-patcher","date":"2024-03-31","url":"https://github.com/Simplifi-ED/CVE-2024-3094-patcher"},{"source":"pocgithub","id":"Yuma-Tsushima07/CVE-2024-3094","title":"Yuma-Tsushima07/CVE-2024-3094","date":"2024-03-31","url":"https://github.com/Yuma-Tsushima07/CVE-2024-3094"},{"source":"pocgithub","id":"isuruwa/CVE-2024-3094","title":"isuruwa/CVE-2024-3094","date":"2024-03-31","url":"https://github.com/isuruwa/CVE-2024-3094"},{"source":"pocgithub","id":"jfrog/cve-2024-3094-tools","title":"jfrog/cve-2024-3094-tools","date":"2024-03-31","url":"https://github.com/jfrog/cve-2024-3094-tools"},{"source":"pocgithub","id":"spidygal/CVE-2024-3094-Nmap-NSE-script","title":"spidygal/CVE-2024-3094-Nmap-NSE-script","date":"2024-03-31","url":"https://github.com/spidygal/CVE-2024-3094-Nmap-NSE-script"},{"source":"pocgithub","id":"0xlane/xz-cve-2024-3094","title":"0xlane/xz-cve-2024-3094","date":"2024-04-01","url":"https://github.com/0xlane/xz-cve-2024-3094"},{"source":"pocgithub","id":"MrBUGLF/XZ-Utils_CVE-2024-3094","title":"MrBUGLF/XZ-Utils_CVE-2024-3094","date":"2024-04-01","url":"https://github.com/MrBUGLF/XZ-Utils_CVE-2024-3094"}],"exploits_more":64,"fixes":[{"ecosystem":"Alpine:v3.15","package":"lighttpd","fixed_in":["1.4.76-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"lighttpd","fixed_in":["1.4.76-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"lighttpd","fixed_in":["1.4.76-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lighttpd","fixed_in":["1.4.76-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xz","fixed_in":["5.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xz","fixed_in":["5.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xz","fixed_in":["5.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xz","fixed_in":["5.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xz","fixed_in":["5.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xz","fixed_in":["5.2.9_p525-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"xz","fixed_in":["5.2.9_p525-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xz-utils","fixed_in":["5.6.1+really5.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xz-utils","fixed_in":["5.6.1+really5.4.5-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"XZ_jll","fixed_in":["5.6.3+0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xz","fixed_in":["5.6.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.76-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.76-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.76-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.76-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8-r0"},{"fixed":"5.2.9_p525-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8-r0"},{"fixed":"5.2.9_p525-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"XZ_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"5.6.0+0"},{"fixed":"5.6.3+0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"tukaani","product":"xz"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-3094","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272210","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/29/4","tags":["x_transferred","Mailing List","web","report"]},{"url":"https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users","tags":["x_transferred","Vendor Advisory","article","web"]},{"url":"https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images","tags":["article","web"]},{"url":"https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/","tags":["x_transferred","web"]},{"url":"https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2024-002/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz","tags":["x_transferred","article","web"]},{"url":"https://boehs.org/node/everything-i-know-about-the-xz-backdoor","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"https://bugs.gentoo.org/928134","tags":["x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1222124","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/advisories/GHSA-rxwq-x6h5-x525","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/amlweems/xzbot","tags":["x_transferred","package","web"]},{"url":"https://github.com/karcherm/xz-malware","tags":["x_transferred","Third Party Advisory","package","web"]},{"url":"https://gynvael.coldwind.pl/?lang=en\u0026id=782","tags":["x_transferred","Technical Description","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00057.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lwn.net/Articles/967180/","tags":["x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://news.ycombinator.com/item?id=39865810","tags":["x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://news.ycombinator.com/item?id=39877267","tags":["x_transferred","Issue Tracking","web"]},{"url":"https://news.ycombinator.com/item?id=39895344","tags":["x_transferred","web"]},{"url":"https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/","tags":["x_transferred","Third Party Advisory","article","web"]},{"url":"https://research.swtch.com/xz-script","tags":["x_transferred","web"]},{"url":"https://research.swtch.com/xz-timeline","tags":["x_transferred","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3094","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-3094","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.archlinux.org/CVE-2024-3094","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240402-0001/","tags":["x_transferred","advisory","web"]},{"url":"https://tukaani.org/xz-backdoor/","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://twitter.com/LetsDefendIO/status/1774804387417751958","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://twitter.com/debian/status/1774219194638409898","tags":["x_transferred","Press/Media Coverage","web"]},{"url":"https://twitter.com/infosecb/status/1774595540233167206","tags":["x_transferred","Press/Media Coverage","web"]},{"url":"https://twitter.com/infosecb/status/1774597228864139400","tags":["x_transferred","Press/Media Coverage","web"]},{"url":"https://ubuntu.com/security/CVE-2024-3094","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094","tags":["x_transferred","Third Party Advisory","US Government Resource","web"]},{"url":"https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.kali.org/blog/about-the-xz-backdoor/","tags":["x_transferred","article","web"]},{"url":"https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils","tags":["x_transferred","Third Party Advisory","article","web"]},{"url":"https://www.theregister.com/2024/03/29/malicious_backdoor_xz/","tags":["x_transferred","Press/Media Coverage","web"]},{"url":"https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094","tags":["x_transferred","web"]},{"url":"https://xeiaso.net/notes/2024/xz-vuln/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/12","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/27","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/12","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/10","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/36","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/16/5","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/8","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/5","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/5","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/4","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3094","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-3094","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-25","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3094.json","tags":["advisory"]},{"url":"https://github.com/tukaani-project/xz","tags":["package"]},{"url":"https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3094","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3094","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-3094","title":"Xz: malicious code in distributed source","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T16:51:12.588Z","modified":"2026-11-04T21:11:43.993Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-506"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2024-31700","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T16:51:12Z","modified":"2026-11-04T21:11:43Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-rxwq-x6h5-x525","title":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The...","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.","status":"published","published":"2024-03-29T18:30:43Z","modified":"2024-03-29T18:30:50Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:55:44.111751Z"}],"nvd":[{"id":"CVE-2024-3094","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T17:15:21.15Z","modified":"2026-11-04T22:17:21.43Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-506"],"updated_at":"2026-11-04T23:43:36.946093Z"}],"osv":[{"id":"ALPINE-CVE-2024-3094","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T17:15:21.15Z","modified":"2026-11-02T11:17:50.087142138Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-3094","status":"published","published":"2024-03-30T05:57:28.539408Z","modified":"2026-01-26T09:36:32.863785Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-3094","title":"Xz: malicious code in distributed source","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T16:51:12.588Z","modified":"2026-11-05T21:16:16.306329503Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"DEBIAN-CVE-2024-3094","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2024-03-29T17:15:21.15Z","modified":"2026-11-05T09:47:32.356255195Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"JLSEC-2026-62","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"published","published":"2026-04-08T16:01:54.18Z","modified":"2026-07-18T00:02:16.463088789Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2024-3094","description":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","status":"withdrawn","published":"2024-03-29T17:15:00Z","modified":"2025-07-16T07:47:12.020393Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"openSUSE-SU-2024:14017-1","title":"liblzma5-32bit-5.6.2-1.1 on GA media","description":"These are all security issues fixed in the liblzma5-32bit-5.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:49.767857Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}