The XZ Utils backdoor, CVE-2024-3094, affected versions 5.6.0 and 5.6.1 and was publicly disclosed on 29 March 2024. It was found by Andres Freund while he investigated slow SSH connections. The more unusual part is the human side: an account built trust with the original maintainer over more than two years.
What was found
Per Wikipedia, the backdoor was discovered on or before 27 March 2024 and disclosed on 29 March. The patch was released as XZ 5.6.2 on 29 May 2024. Freund, described as a Microsoft employee, was investigating a performance regression in a Debian development version. He saw unexpectedly high CPU use from SSH connections and errors in Valgrind, a memory debugging tool. He reported to Debian and later to the Openwall Project.
The trust campaign
The article says a user going by Jia Tan ran a campaign starting in 2021 that lasted over two years. It describes sock puppetry, a pressure campaign against the original maintainer, and eventually maintainer permissions. Several usernames are named as suspected sock puppets, but the article says these are suspected pseudonyms, so this post does not repeat them as fact. Nothing here identifies a real person, and none of it should be taken as proof of who was behind the account.
Why this matters
A technical control cannot see social pressure. The project was run by a tired volunteer, and new help was welcome. That is common across open source, which is why the pattern is worrying.
What you can do as a consumer
- Watch for ownership changes in dependencies you rely on, especially for small, widely used packages.
- Prefer builds you can reproduce and releases tied to tagged source.
- Treat unexplained performance changes as a signal worth checking.
- Keep an inventory so that when a disclosure lands, you know within minutes whether you use the package.
What you can do as a maintainer
- Share the load. A second reviewer for releases makes pressure harder.
- Be careful with new maintainer grants, and give them gradually.
- Say no to pressure to hurry, and ask for a second opinion.
A caution
It is easy to learn the wrong thing from this event, for example that contributors from outside should be distrusted. The better reading is that no single person should hold unchecked release power.
Signals worth watching
A few signals can prompt a closer look at a dependency. A new maintainer takes over a small but critical package. Release practices change, for example tarballs that no longer match tagged source. Build scripts gain complexity without a clear reason. Binary test files appear in a package that had none. None of these proves anything alone, and the sources used here do not say which signals were present in this case. They are prompts for a second look, and a note in your tracker costs almost nothing.
Quick check
Who found the backdoor and how?
Andres Freund, while investigating high CPU use and Valgrind errors in SSH connections on a Debian development version.
Which versions were affected?
XZ Utils 5.6.0 and 5.6.1.
Safeguard's SBOM and dependency scanning help you answer quickly whether a package is in your estate, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
