CVE-2024-3094
CriticalMalicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Published Mar 29, 2024 · Updated Aug 30, 2026 · Also known as ALPINE-CVE-2024-3094, DEBIAN-CVE-2024-3094, GHSA-rxwq-x6h5-x525, JLSEC-2026-62, Jia Tan backdoor, UBUNTU-CVE-2024-3094, XZ backdoor, liblzma backdoor, xz-utils backdoor
Key Facts
Patch immediately- CVE-2024-3094 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Xz (Tukaani), lighttpd (alpine), rootio-xz and 10 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 91% probability of exploitation in the next 30 days.
- Fixed versions are available, including liblzma5 5.6.2-1.1, liblzma5-32bit 5.6.2-1.1, liblzma5-x86-64-v3 5.6.2-1.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
91%
Higher than 99.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-3094 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Affected Products
41 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| XzTukaani | 5.6.0, 5.6.1, >= 5.6.0 | 5.6.1-r2 |
| lighttpdalpine | See advisory | 1.4.76-r0 |
| rootio-xzrootio | See advisory | 5.6.1-r2 |
| xz-utilsdebian | See advisory | 5.6.1+really5.4.5-1 |
| rootio-xz-utilsrootio | See advisory | 5.6.1+really5.4.5-1 |
Patched Releases
liblzma5
5.6.2-1.1
liblzma5-32bit
5.6.2-1.1
liblzma5-x86-64-v3
5.6.2-1.1
lighttpd
1.4.76-r0
rootio-xz
5.6.1-r2
rootio-xz-utils
5.6.1+really5.4.5-1
seal-xz-utils
5.4.1-0.2+sp999
Xz
5.6.1-r2, 5.6.2-1.1
XZ_jll
5.6.3+0
xz-devel
5.6.2-1.1
xz-devel-32bit
5.6.2-1.1
xz-lang
5.6.2-1.1
xz-utils
5.4.1-0.2+sp999, 5.6.1+really5.4.5-1
Timeline
Publicly disclosed
Mar 29, 2024
Last updated
Aug 30, 2026
Weakness Type
- CWE-506 Embedded Malicious Code
References
- advisoryhttps://access.redhat.com/security/cve/CVE-2024-3094
- advisoryhttps://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
- advisoryhttps://aws.amazon.com/security/security-bulletins/AWS-2024-002/
- advisoryhttps://boehs.org/node/everything-i-know-about-the-xz-backdoor
- advisoryhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
FAQ
Common Questions.
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Affected: Xz (Tukaani) versions 5.6.0, 5.6.1, >= 5.6.0; lighttpd (alpine); rootio-xz, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including liblzma5 5.6.2-1.1, liblzma5-32bit 5.6.2-1.1, liblzma5-x86-64-v3 5.6.2-1.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-3094 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo