# XZ Utils Backdoor (CVE-2024-3094) The XZ Utils backdoor, with CVSS v3.1 10.0 and CWE-506 Embedded Malicious Code, and not in the CISA KEV catalog. Source: https://docs.deepinfo.com/reference/vulnerability/detail/examples/cve-2024-3094/ Last updated: 2026-09-24 --- `GET https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2024-3094` The XZ Utils backdoor, with CVSS v3.1 10.0 and CWE-506 Embedded Malicious Code, and not in the CISA KEV catalog. Example 6 of 7 in **Well-Known CVEs** · [Vulnerability Detail Examples](/reference/vulnerability/detail/examples/) · endpoint: [Detail](/reference/vulnerability/detail/) Tags: `param` `cve` · `value` `CVE-2024-3094` Asks for `CVE-2024-3094`, the malicious code found in the xz release tarballs. ## What to Notice - `enrichment.cwe` is CWE-506, Embedded Malicious Code. - `enrichment.cisa_kev` is `null`: the CVE is not in the CISA KEV catalog. - `status` is `Modified`: the NVD changed the record after its analysis. ## Request | Parameter | In | Value | |---|---|---| | `cve` | query | `CVE-2024-3094` | ```bash curl 'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2024-3094' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' ``` ## Response ### 200 · OK > Shortened for this page: references: 10 of 59 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "id": "CVE-2024-3094", "source_identifier": "user@redhat.com", "published": "2024-03-29T17:15:21Z", "last_modified": "2026-06-17T07:43:17Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library." }, { "lang": "es", "value": "Se descubrió código malicioso en los archivos tar ascendentes de xz, a partir de la versión 5.6.0. A través de una serie de ofuscaciones complejas, el proceso de compilación de liblzma extrae un archivo objeto premanipulado de un archivo de prueba disfrazado existente en el código fuente, que luego se utiliza para modificar funciones específicas en el código de liblzma. Esto da como resultado una librería liblzma modificada que puede ser utilizada por cualquier software vinculado a esta librería, interceptando y modificando la interacción de datos con esta librería." } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2024-3094", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Vendor Advisory" ] }, { "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "user@redhat.com", "tags": [ "Mailing List" ] }, { "url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/10", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/5", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/8", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/30/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-506" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "match_criteria_id": "73F1DAD7-F362-4C5B-B980-2E5313C369DA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "match_criteria_id": "55782A0B-B9C5-4536-A885-84CAB7029C09", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.0", "affected_versions_last": "5.6.0", "affected_versions": [ "5.6.0" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.1", "affected_versions_last": "5.6.1", "affected_versions": [ "5.6.1" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "deprecated": false } ] } ], "cwe": [ { "id": 506, "owasptop10_2021": null, "name": "Embedded Malicious Code", "description": "The product contains code that appears to be malicious in nature.", "capec_id": [ 442, 448, 636 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Automated Static Analysis", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.85974, "percentile": 0.99719, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ``` ## Related Examples - [Citrix Bleed (CVE-2023-4966)](/reference/vulnerability/detail/examples/cve-2023-4966/) - [OpenSSH regreSSHion (CVE-2024-6387)](/reference/vulnerability/detail/examples/cve-2024-6387/) - [Log4Shell (CVE-2021-44228)](/reference/vulnerability/detail/examples/cve-2021-44228/) - [EternalBlue (CVE-2017-0144)](/reference/vulnerability/detail/examples/cve-2017-0144/) - [Shellshock (CVE-2014-6271)](/reference/vulnerability/detail/examples/cve-2014-6271/) - [Heartbleed (CVE-2014-0160)](/reference/vulnerability/detail/examples/cve-2014-0160/)