CVE-2025-58058: Memory Leak in github.com/ulikunitz/xz Due to Corrupted LZMA Archives

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The package github.com/ulikunitz/xz is a Go library that provides functionality for reading and writing xz-compressed files, specifically using the LZMA compression algorithm. It is widely used in applications that require efficient data compression and decompression. However, a vulnerability has been identified in versions up to 0.5.13, where the library can leak memory when decoding corrupted LZMA archives, potentially leading to performance issues or application crashes.

Vulnerability Detail

The vulnerability arises from the inability of the library to detect data corruption in LZMA-encoded byte streams before allocating memory for decoding. Specifically, if a zero byte is added to the beginning of an LZMA archive, it can trigger a memory spike and an error during the decoding process. This occurs because the library allocates the full decoding buffer immediately after reading the header, without validating the integrity of the data. The lack of a magic number or checksum in the LZMA header exacerbates this issue, allowing corrupted data to go undetected until it is too late.

go get github.com/ulikunitz/xz@v0.5.17

go get github.com/ulikunitz/xz@v0.5.15

Workaround

If you cannot update to the patched version immediately, consider implementing a check before decoding LZMA archives to ensure that the input data is valid. Here is a sample code snippet that demonstrates how to handle LZMA decoding safely:

const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, "tmpLZMAPrefix")
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}

Conclusion

The vulnerability CVE-2025-58058 in the github.com/ulikunitz/xz package poses a risk of memory leaks when handling corrupted LZMA archives. It is crucial to update to version 0.5.15 or later to mitigate this issue. Implementing proper checks and using tools like Vulert can help in managing and monitoring vulnerabilities effectively.

See every vulnerability recorded for github.com/ulikunitz/xz →

FAQ