CVE-2025-58058: 
Terraform Community vulnerability analysis and mitigation

CVE-2025-58058 affects the golang github.com/ulikunitz/xz package, specifically versions prior to 0.5.14. The vulnerability was discovered and disclosed on August 28, 2025. The issue allows attackers to cause increased memory consumption by manipulating LZMA-encoded byte streams. The vulnerability stems from the package's inability to detect data placed in front of an LZMA-encoded byte stream while reading the header, leading to potentially excessive memory allocation (GitHub Advisory).

The vulnerability occurs because the LZMA format doesn't include a magic marker or checksum in the header to detect malformed streams. When reading a corrupted stream with a zero byte prefix, the implementation allocates the full decoding buffer immediately after reading the header. While the code eventually detects stream issues during processing, the memory allocation has already occurred. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network accessibility with low attack complexity and no required privileges or user interaction (GitHub Advisory).

The primary impact is on memory resource consumption, particularly affecting servers with limited RAM that process large numbers of unverified LZMA archives. When exploited, the vulnerability can cause sharp spikes in memory usage, overwhelming the garbage collector's ability to manage memory effectively (GitHub Advisory).

The issue has been patched in version 0.5.14 with several mitigations: The ReaderConfig DictCap field now acts as an upper limit for dictionary size with a default of 2 gigabytes, dictionary size is limited to the larger of the file size and minimum dictionary size, and the code only supports stream sizes up to a pebibyte (1024^5). Users can check actual values using the Reader.Header method and set appropriate limits via ReaderConfig. Note that version 0.5.15 was released to fix a compiler error on 32-bit platforms present in 0.5.14 (GitHub Advisory).