Vulnerability Lookup

🛡️ JLSEC-2026-62

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Details

Severity Unknown

CVSS Score N/A

CVSS Vector N/A

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2026-04-08

Updated 2026-06-02

Modified 2026-04-08

Fix URL N/A

Affected Packages

Software	From version	Fixed in
xz-jll	—	—

References

WEB https://access.redhat.com/security/cve/CVE-2024-3094

WEB https://bugzilla.redhat.com/show_bug.cgi?id=2272210

WEB https://www.openwall.com/lists/oss-security/2024/03/29/4

WEB https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

WEB http://www.openwall.com/lists/oss-security/2024/03/29/10

WEB http://www.openwall.com/lists/oss-security/2024/03/29/12

WEB http://www.openwall.com/lists/oss-security/2024/03/29/4

WEB http://www.openwall.com/lists/oss-security/2024/03/29/5

WEB http://www.openwall.com/lists/oss-security/2024/03/29/8

WEB http://www.openwall.com/lists/oss-security/2024/03/30/12

WEB http://www.openwall.com/lists/oss-security/2024/03/30/27

WEB http://www.openwall.com/lists/oss-security/2024/03/30/36

WEB http://www.openwall.com/lists/oss-security/2024/03/30/5

WEB http://www.openwall.com/lists/oss-security/2024/04/16/5

WEB https://access.redhat.com/security/cve/CVE-2024-3094

WEB https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/

WEB https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/

WEB https://aws.amazon.com/security/security-bulletins/AWS-2024-002/

WEB https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz

WEB https://boehs.org/node/everything-i-know-about-the-xz-backdoor

WEB https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024

WEB https://bugs.gentoo.org/928134

WEB https://bugzilla.redhat.com/show_bug.cgi?id=2272210

WEB https://bugzilla.suse.com/show_bug.cgi?id=1222124

WEB https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405

WEB https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

WEB https://github.com/advisories/GHSA-rxwq-x6h5-x525

WEB https://github.com/amlweems/xzbot

WEB https://github.com/karcherm/xz-malware

WEB https://gynvael.coldwind.pl/?lang=en&id=782

WEB https://lists.debian.org/debian-security-announce/2024/msg00057.html

WEB https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html

WEB https://lwn.net/Articles/967180/

WEB https://news.ycombinator.com/item?id=39865810

WEB https://news.ycombinator.com/item?id=39877267

WEB https://news.ycombinator.com/item?id=39895344

WEB https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/

WEB https://research.swtch.com/xz-script

WEB https://research.swtch.com/xz-timeline

WEB https://security-tracker.debian.org/tracker/CVE-2024-3094

WEB https://security.alpinelinux.org/vuln/CVE-2024-3094

WEB https://security.archlinux.org/CVE-2024-3094

WEB https://security.netapp.com/advisory/ntap-20240402-0001/

WEB https://tukaani.org/xz-backdoor/

WEB https://twitter.com/LetsDefendIO/status/1774804387417751958

WEB https://twitter.com/debian/status/1774219194638409898

WEB https://twitter.com/infosecb/status/1774595540233167206

WEB https://twitter.com/infosecb/status/1774597228864139400

WEB https://ubuntu.com/security/CVE-2024-3094

WEB https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images

WEB https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

WEB https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils

WEB https://www.kali.org/blog/about-the-xz-backdoor/

WEB https://www.openwall.com/lists/oss-security/2024/03/29/4

WEB https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

WEB https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

WEB https://www.theregister.com/2024/03/29/malicious_backdoor_xz/

WEB https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094

WEB https://xeiaso.net/notes/2024/xz-vuln/

🔗 NVD 🔗 Mitre

Similar Threats

Unknown JLSEC-2026-462
Unknown JLSEC-2026-61

Exploit Protection

Help block exploit attempts

BotEraser is designed to detect and help reduce malicious bot traffic that may target known vulnerabilities on your site.

Try BotEraser Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Help block exploit attempts

Company

Resources

Services

Trusted

Subscribe