CVE-2021-29482: Xz Project Xz

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

Affected products

• Xz Project Xz: before 0.5.8 (fixed in 0.5.8)

Published 2021-04-28. Last modified 2026-06-17.