What is the GHSA ID for CVE-2024-3094?

GitHub tracks CVE-2024-3094 as GHSA-rxwq-x6h5-x525.

What is the CVSS score of CVE-2024-3094?

CVE-2024-3094 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Which versions are affected by CVE-2024-3094?

https://github.com/tukaani-project/xz (GIT): = 5.6.0; = 5.6.1.

How do I fix CVE-2024-3094?

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

What is the Package URL (PURL) for CVE-2024-3094?

The affected package's PURL is pkg:github/tukaani-project/xz.

Is CVE-2024-3094 exploited in the wild?

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-3094. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 85.97% chance of exploitation in the next 30 days, higher than 99.7% of CVEs.

CVE-2024-3094GHSA-rxwq-x6h5-x525

Xz: malicious code in distributed source

CVE-2024-3094 (GitHub advisory GHSA-rxwq-x6h5-x525) is a critical-severity vulnerability with a CVSS 3.1 base score of 10.0, classed as Embedded Malicious Code (CWE-506), in github.com/tukaani-project/xz (Git repository). Affected versions: = 5.6.0; = 5.6.1. No fixed version has been published yet.

Critical10.0No fix yetUnreviewed advisory

Published 29 Mar 2024Updated 4 Aug 2026

10.0CriticalCVSS 3.1

CVE ID: CVE-2024-3094
GHSA ID: GHSA-rxwq-x6h5-x525
EPSS: 85.97%higher than 99.7% of CVEs
Weakness (CWE): CWE-506Embedded Malicious Code
KEV status: Not in KEV
Published: 29 Mar 2024
Updated: 4 Aug 2026
Ecosystem: Git repositories
Assigned by (CNA): redhat

Summary

Source: GitHub Advisory Database

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Critical10.0Base score from GitHub Advisory Database

Attack Vector AV: Network
Attack Complexity AC: Low
Privileges Required PR: None
User Interaction UI: None
Scope S: Changed
Confidentiality C: High
Integrity I: High
Availability A: High

CISA SSVC decision points

Exploitation: none; No public exploitation evidence
Automatable: yes; Attackers can automate this at scale
Technical impact: total; Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (CVE record)

https://github.com/tukaani-project/xz
Git repositories
pkg:github/tukaani-project/xz
Affected versions
= 5.6.0
= 5.6.1
Fixed in
None after 5.6.0, 5.6.1
Show 4 listed versions
- 5.6.0
- 5.6.1
- v5.6.1
- v5.6.0

Package	Affected versions	Fixed in
https://github.com/tukaani-project/xz Git repositories `pkg:github/tukaani-project/xz`	= 5.6.0 = 5.6.1 Show 4 listed versions 5.6.0 5.6.1 v5.6.1 v5.6.0	None after 5.6.0, 5.6.1

Fix

Source: OSV (CVE record)

No fixed version has been published

Every version in the affected ranges above is vulnerable. Look for mitigations in the advisory and references, and watch the vendor for a release.

Vulnerability intelligence

References

Advisories 5

Reports and issues 2

Write-ups 6

Package 3

Credits

Red Hat would like to thank Andres Freund for reporting this issue.

Questions about CVE-2024-3094

What is the GHSA ID for CVE-2024-3094?: GitHub tracks CVE-2024-3094 as GHSA-rxwq-x6h5-x525.
What is the CVSS score of CVE-2024-3094?: CVE-2024-3094 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Which versions are affected by CVE-2024-3094?: https://github.com/tukaani-project/xz (GIT): = 5.6.0; = 5.6.1.
How do I fix CVE-2024-3094?: No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.
What is the Package URL (PURL) for CVE-2024-3094?: The affected package's PURL is pkg:github/tukaani-project/xz.
Is CVE-2024-3094 exploited in the wild?: CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-3094. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 85.97% chance of exploitation in the next 30 days, higher than 99.7% of CVEs.

Data sources

Upstream records

OSV (GitHub advisory)No record
GitHub Advisory DatabaseLoadedRaw JSON
OSV (CVE record)LoadedRaw JSON
CVE.orgLoaded
CISA KEV catalogLoaded

Fetched 1 day ago (15 Oct 2026, 04:37 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description: GitHub Advisory Database
Severity score: GitHub Advisory Database
Weakness (CWE): GitHub Advisory Database
Affected packages: OSV (CVE record)
Fix: OSV (CVE record)
References: Computed by CVEminer
SSVC: CVE.org
KEV status: CISA KEV catalog
EPSS: GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.