{"id":"CVE-2026-34743","aliases":["ALPINE-CVE-2026-34743","ALSA-2026:64787","ALSA-2026:89749","AZL-81800","AZL-81905","AZL-81908","BELL-CVE-2026-34743","CLSA-2026-1779894244","CLSA-2026-1780518704","DEBIAN-CVE-2026-34743","EUVD-2026-18505","GHSA-x872-m794-cxhv","JLSEC-2026-462","MGASA-2026-0084","OESA-2026-1853","RHSA-2026:64787","RHSA-2026:7647","RLSA-2026:64787","RLSA-2026:89749","RLSA-2026:98486","ROOT-OS-DEBIAN-11-CVE-2026-34743","ROOT-OS-DEBIAN-12-CVE-2026-34743","ROOT-OS-DEBIAN-13-CVE-2026-34743","SUSE-SU-2026:2051-1","SUSE-SU-2026:2052-1","SUSE-SU-2026:2118-1","SUSE-SU-2026:21729-1","SUSE-SU-2026:21740-1","SUSE-SU-2026:21835-1","SUSE-SU-2026:21848-1","UBUNTU-CVE-2026-34743","USN-8362-1","openSUSE-SU-2026:10492-1","openSUSE-SU-2026:20813-1"],"status":"published","title":"XZ Utils: Buffer overflow in lzma_index_append()","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","severity":{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00534,"percentile":0.45594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-04-02T18:36:37Z","modified":"2026-11-12T00:30:03Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-devel","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-libs","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xz-lzma-compat","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xz","fixed_in":["5.2.5-8.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xz-devel","fixed_in":["5.2.5-8.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xz-libs","fixed_in":["5.2.5-8.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xz-lzma-compat","fixed_in":["5.2.5-8.el9_8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"xz","fixed_in":["5.4.4-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-28","1.90.0-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xz","fixed_in":["5.2.9_p525-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"xz","fixed_in":["5.2.9_p525-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"xz","fixed_in":["5.8.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz","fixed_in":["5.2.5-8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-devel","fixed_in":["5.2.5-8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-libs","fixed_in":["5.2.5-8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-lzma-compat","fixed_in":["5.2.5-8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-static","fixed_in":["5.2.5-8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz","fixed_in":["5.2.5-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-devel","fixed_in":["5.2.5-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-libs","fixed_in":["5.2.5-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-lzma-compat","fixed_in":["5.2.5-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-static","fixed_in":["5.2.5-8.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xz-utils","fixed_in":["5.4.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xz-utils","fixed_in":["5.8.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xz-utils","fixed_in":["5.8.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"XZ_jll","fixed_in":["5.8.3+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xz","fixed_in":["5.4.3-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xz","fixed_in":["5.2.5-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xz","fixed_in":["5.2.5-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xz","fixed_in":["5.4.7-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"xz","fixed_in":["5.4.7-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"xz","fixed_in":["5.4.7-8.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"xz","fixed_in":["5.4.7-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-debuginfo","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-debugsource","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-devel","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-libs-debuginfo","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-lzma-compat","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-lzma-compat-debuginfo","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-libs","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"xz","fixed_in":["0:5.8.3-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"xz-devel","fixed_in":["0:5.8.3-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"xz-libs","fixed_in":["0:5.8.3-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"xz-lzma-compat","fixed_in":["0:5.8.3-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"xz-static","fixed_in":["0:5.8.3-1.1.hum1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"xz","fixed_in":["1:5.6.2-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"xz","fixed_in":["0:5.2.5-8.el9_8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xz-utils","fixed_in":["5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xz-utils","fixed_in":["5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xz-utils","fixed_in":["5.2.2-1.3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xz-utils","fixed_in":["5.2.4-1ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xz-utils","fixed_in":["5.2.5-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","fixed_in":["5.6.1+really5.4.5-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"xz-utils","fixed_in":["5.8.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xz","fixed_in":["5.8.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.4-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-28"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8-r0"},{"fixed":"5.2.9_p525-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.1-r0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.1-r0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8-r0"},{"fixed":"5.2.9_p525-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.1-r0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.1-r0"},{"fixed":"5.8.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"xz-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"xz-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-8.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1+deb12u1"}]}],"versions":["5.4.1-0.2","5.4.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1+deb13u1"}]}],"versions":["5.8.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-1"}]}],"versions":["5.8.1-1","5.8.1-1.1","5.8.1-2","5.8.2-1","5.8.2-2"]},{"source":"osv","ecosystem":"Julia","package":"XZ_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.8.3+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-8.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.7-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-lzma-compat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.3-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.3-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xz-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.3-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xz-lzma-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.3-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xz-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.3-1.1.hum1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.2-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5-8.el9_8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2"}]}],"versions":["5.1.1alpha+20120614-2ubuntu1","5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2"}]}],"versions":["5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.3ubuntu0.1+esm1"}]}],"versions":["5.2.2-1.3","5.2.2-1.3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-1ubuntu1.1+esm1"}]}],"versions":["5.2.4-1","5.2.4-1ubuntu1","5.2.4-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-2ubuntu1.1"}]}],"versions":["5.2.5-2","5.2.5-2build1","5.2.5-2build2","5.2.5-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1ubuntu0.3"}]}],"versions":["5.4.1-0.2","5.4.4-0.1","5.4.5-0.1","5.4.5-0.3","5.6.0-0.2","5.6.1+really5.4.5-1","5.6.1+really5.4.5-1build0.1","5.6.1+really5.4.5-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1ubuntu0.1"}]}],"versions":["5.6.4-1ubuntu1","5.8.1-1","5.8.1-1build1","5.8.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2"}]}],"versions":["5.1.1alpha+20120614-2ubuntu1","5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2"}]}],"versions":["5.1.1alpha+20120614-2ubuntu2","5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.3ubuntu0.1+esm1"}]}],"versions":["5.2.2-1.3","5.2.2-1.3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-1ubuntu1.1+esm1"}]}],"versions":["5.2.4-1","5.2.4-1ubuntu1","5.2.4-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-2ubuntu1.1"}]}],"versions":["5.2.5-2","5.2.5-2build1","5.2.5-2build2","5.2.5-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1+really5.4.5-1ubuntu0.3"}]}],"versions":["5.4.1-0.2","5.4.4-0.1","5.4.5-0.1","5.4.5-0.3","5.6.0-0.2","5.6.1+really5.4.5-1","5.6.1+really5.4.5-1build0.1","5.6.1+really5.4.5-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xz-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.1-1ubuntu0.1"}]}],"versions":["5.6.4-1ubuntu1","5.8.1-1","5.8.1-1build1","5.8.1-1build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.3-1.1"}]}]}],"products":[{"vendor":"tukaani","product":"xz"},{"vendor":"tukaani-project","product":"xz"}],"references":[{"url":"https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article"]},{"url":"https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/tukaani-project/xz/releases/tag/v5.8.3","tags":["x_refsource_MISC","Product","Release Notes","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/31/13","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34743","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64787","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34743","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454589","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-64787.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89749","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-89749.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34743","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34743","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779894244.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780518704.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34743.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34743","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0084.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35307","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/31/13","tags":["web"]},{"url":"https://tukaani.org/xz/index-append-overflow.html","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1853","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454589","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64787.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34743","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7647","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7647.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:64787","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89749","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98486","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98486","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262051-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261280","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34743","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262052-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262118-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621729-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621740-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621835-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621848-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34743","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8362-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34743","title":"XZ Utils: Buffer overflow in lzma_index_append()","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T18:36:37.45Z","modified":"2026-07-21T22:19:21.175Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-18505","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T18:36:37Z","modified":"2026-07-21T22:19:21Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"nvd":[{"id":"CVE-2026-34743","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33.187Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"ALPINE-CVE-2026-34743","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33.187Z","modified":"2026-10-01T02:17:49.259544009Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-34743","status":"published","published":"2026-04-04T06:09:29.690053Z","modified":"2026-05-04T07:15:39.418534Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34743","title":"XZ Utils: Buffer overflow in lzma_index_append()","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T18:36:37.45Z","modified":"2026-10-28T11:12:10.027434325Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34743","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33.187Z","modified":"2026-10-01T03:03:04.492441525Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-462","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if `lzma_index_decoder()` was used to decode an Index that contained no Records, the resulting `lzma_index` was left in a state where where a subsequent `lzma_index_append()` would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-05-07T15:03:46.925Z","modified":"2026-07-25T18:24:29.385018558Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1853","title":"xz security update","description":"XZ Utils is free general-purpose data compression software with a high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils.\r\n\r\nSecurity Fix(es):\n\nXZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.(CVE-2026-34743)","status":"published","published":"2026-04-11T11:10:52Z","modified":"2026-08-18T01:19:47.074725599Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:64787","title":"Red Hat Security Advisory: xz security update","status":"published","published":"2026-09-08T10:19:03Z","modified":"2026-10-10T10:17:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:7647","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:17Z","modified":"2026-10-10T10:21:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:64787","title":"Moderate: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.\n\nSecurity Fix(es):\n\n* xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-09T12:09:16.585859Z","modified":"2026-09-09T12:30:03.343426088Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:89749","title":"Moderate: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.\n\nSecurity Fix(es):\n\n* xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:04:29.081572Z","modified":"2026-10-27T12:30:03.121470597Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98486","title":"Moderate: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.\n\nSecurity Fix(es):\n\n* xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.640480167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-34743","title":"CVE-2026-34743 in xz-utils - Patched by Root","description":"Root has patched CVE-2026-34743 in the xz-utils package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-23T08:17:46Z","modified":"2026-10-09T13:00:06.4928536Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-34743","title":"CVE-2026-34743 in xz-utils - Patched by Root","description":"Root has patched CVE-2026-34743 in the xz-utils package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-26T07:43:32Z","modified":"2026-09-24T14:00:04.993482802Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-34743","title":"CVE-2026-34743 in rootio-xz-utils - Patched by Root","description":"Root has patched CVE-2026-34743 in the rootio-xz-utils package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-04-27T07:36:27Z","modified":"2026-08-27T14:00:04.406618722Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-34743","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:00Z","modified":"2026-06-02T14:00:18.179184024Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:64787","title":"Moderate: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.  \n\nSecurity Fix(es):  \n\n  * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-10-29T11:30:49.468673477Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:89749","title":"Moderate: xz security update","description":"XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.  \n\nSecurity Fix(es):  \n\n  * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.67146225Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-81800","title":"CVE-2026-34743 affecting package xz for versions less than 5.4.4-3","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"AZL-81905","title":"CVE-2026-34743 affecting package rust for versions less than 1.75.0-28","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"AZL-81908","title":"CVE-2026-34743 affecting package rust for versions less than 1.90.0-7","description":"XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.","status":"published","published":"2026-04-02T19:21:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1779894244","title":"xz: Fix of CVE-2026-34743","description":"- CVE-2026-34743: fix buffer overflow in lzma_index_append","status":"published","published":"2026-05-27T15:33:35Z","modified":"2026-10-26T09:30:06.874459266Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780518704","title":"xz: Fix of CVE-2026-34743","description":"- CVE-2026-34743: fix buffer overflow in lzma_index_append","status":"published","published":"2026-06-03T20:31:57Z","modified":"2026-10-26T09:31:05.089677228Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"MGASA-2026-0084","title":"Updated xz packages fix security vulnerability","description":"Buffer overflow in lzma_index_append(). (CVE-2026-34743)\n","status":"published","published":"2026-04-06T17:35:50Z","modified":"2026-04-16T04:41:33.96024976Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10492-1","title":"liblzma5-32bit-5.8.3-1.1 on GA media","description":"These are all security issues fixed in the liblzma5-32bit-5.8.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-04T00:00:00Z","modified":"2026-04-05T10:32:42.801218Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20813-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-26T12:14:16Z","modified":"2026-05-29T18:24:10.753835292Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:2051-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-25T13:59:51Z","modified":"2026-05-26T08:15:06.757139181Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2052-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-25T14:00:00Z","modified":"2026-05-26T08:15:05.296644233Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2118-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-29T15:32:03Z","modified":"2026-05-30T23:15:06.404607435Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21729-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-21T12:03:57Z","modified":"2026-05-23T18:23:41.725982693Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21740-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-21T12:22:12Z","modified":"2026-05-23T18:23:40.378211436Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21835-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-26T12:19:48Z","modified":"2026-05-31T18:24:29.015776712Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21848-1","title":"Security update for xz","description":"This update for xz fixes the following issue\n\n- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).\n","status":"published","published":"2026-05-26T12:19:48Z","modified":"2026-06-02T18:24:26.953972243Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8362-1","title":"xz-utils vulnerability","description":"It was discovered that XZ Utils did not properly manage memory when\nattempting to append data to a decoded index that contained no records.\nAn attacker could possibly use this issue to cause XZ Utils to crash,\nresulting in a denial of service, or execute arbitrary code.","status":"published","published":"2026-06-02T09:17:00Z","modified":"2026-06-02T14:14:25.491935661Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}