Skip to content
OpenAdvisories
Low RHSA-2026:64787 1 CVE

Red Hat Security Advisory: xz security update

Published Sep 8, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 xz 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-debuginfo 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-debugsource 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-devel 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-libs 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-libs-debuginfo 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-lzma-compat 1:5.6.2-4.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 xz-lzma-compat-debuginfo 1:5.6.2-4.el10_2.1

Vulnerabilities 1

  • Low 1.7
    CVE-2026-34743

    XZ Utils: Buffer overflow in lzma_index_append()

    XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent l…

    tukaani-project xz rust xz Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2454589
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64787.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-34743
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34743
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34743
  • article
    https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
  • article
    https://github.com/tukaani-project/xz/releases/tag/v5.8.3
  • article
    https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv