← Vulnerability feed

Vulnerability record · CVE-2020-22916 · published 22 August 2023

CVE-2020-22916: Tukaani xz vulnerability

Tukaani · Xz

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

5.5 CVSS 3.1 Medium EPSS 0.25% · top 85.5%
5.5CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References
17 Jun 2026Last modified by NVD

Description

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulne
https://bugzilla.redhat.com/show_bug.cgi?id=2234987
https://bugzilla.suse.com/show_bug.cgi?id=1214590
https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability Broken Link
https://github.com/tukaani-project/xz/issues/61
https://security-tracker.debian.org/tracker/CVE-2020-22916
https://tukaani.org/xz/ Product
http://web.archive.org/web/20230918084612/https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulne
https://bugzilla.redhat.com/show_bug.cgi?id=2234987
https://bugzilla.suse.com/show_bug.cgi?id=1214590
https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability Broken Link
https://github.com/tukaani-project/xz/issues/61
https://security-tracker.debian.org/tracker/CVE-2020-22916
https://tukaani.org/xz/ Product

Track CVE-2020-22916 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-3094XZ Utils liblzma backdoor via malicious build-time code injectionMalicious code was inserted into upstream xz tarballs starting with version 5.6.0. The liblzma build process extracts a prebuilt object file from a d…EPSS 86%analysed8.8CVE-2022-1271Gnu gzip improper input validation vulnerabilityAn arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a…EPSS 5.1%7.8CVE-2015-4035Tukaani xz improper input validation vulnerabilityscripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attacker…EPSS 0.99%1.7CVE-2026-34743Tukaani xz heap-based buffer overflow vulnerabilityXZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to deco…EPSS 0.57%

Source: NIST National Vulnerability Database (record CVE-2020-22916), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.