AIKIDO-2026-699471
lzma-rust2 is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
lzma-rust2TL;DR
The LZMA, LZMA2 and XZ decoders size their decompression buffers directly from length fields read out of the archive, and several parsing paths use unchecked arithmetic and infallible unwraps. A crafted archive can declare a very large dictionary size or block/index size, causing the decoder to attempt an enormous eager allocation that exhausts memory and aborts the process. Malformed inputs can also trigger integer-overflow panics in the BCJ filters and panics in the multi-threaded LZIP reader when a seek or read fails. The fix defers dictionary allocation and makes it fallible, validates sizes with checked arithmetic, and replaces panicking unwraps with proper error propagation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and decompress archives from untrusted sources.
Background info
lzma-rust2 is vulnerable to Uncontrolled Resource Consumption in versions 0.1.7 - 0.16.4.
How to fix this
Upgrade the lzma-rust2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant