Moderate Vulnerability in XZ Package: Denial of Service via Buffer Overflow
Summary
ALSA-2026:64787: Moderate: xz security update. Affects xz versions < 1:5.6.2-4.el10_2.1. Fixed in 1:5.6.2-4.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XZ Utils is a suite of user-space file compression utilities that utilize the Lempel-Ziv-Markov chain algorithm (LZMA) for lossless data compression. It is known for achieving high compression ratios while maintaining quick decompression speeds. However, a recent security issue has been identified that affects the integrity and availability of the XZ package, specifically in its handling of index decoding.
Vulnerability Detail
The vulnerability, identified as CVE-2026-34743, is a Denial of Service (DoS) issue caused by a buffer overflow in the index decoding process of the XZ package. This flaw allows an attacker to exploit the buffer overflow, potentially leading to application crashes or unexpected behavior, thereby compromising the availability of the service relying on this package.
How To Fix
Minimum fixed version
1:5.6.2-4.el10_2.1
This is the first release that contains the fix.
sudo dnf update xzTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you are unable to update the package immediately, consider limiting the exposure of the affected application to untrusted inputs that could trigger the buffer overflow. This may involve implementing stricter input validation or using firewalls to restrict access.
Conclusion
The XZ package has a moderate vulnerability that can lead to Denial of Service attacks due to a buffer overflow in index decoding. It is crucial to update to the latest patched version to ensure the security and availability of your applications. For ongoing monitoring of vulnerabilities, consider using Vulert, which can alert you in real-time without requiring code access.
See every vulnerability recorded for xz →
FAQ
CVE-2026-34743 is a security vulnerability in the XZ package that allows for a Denial of Service attack through a buffer overflow in index decoding.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a Denial of Service, which can cause the application to crash or behave unexpectedly, affecting its availability.
Yes, a patch is available. Updating to version 1:5.6.2-4.el10_2.1 or later will resolve the issue.
If an immediate update is not possible, consider implementing input validation and restricting access to the application to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for xz.
