What is CVE-2024-3094 (the xz backdoor) and which versions are affected?

Answered byPackage Vulnerability Check API: CVEs, CISA KEV, safe upgrade

Price$0.005 per package version or CVE answered (HTTP API)

StatusOn the HTTP API

CVE-2024-3094 is the backdoor found in the upstream xz release tarballs from version 5.6.0 (5.6.0 and 5.6.1), rated CVSS 10 CRITICAL by NVD. The row combines the NVD record (description, CWE-506, dates), the OSV.dev entry and the FIRST EPSS exploit-probability score, each with its source_url.

Tool input

{
  "vulnerabilityId": "CVE-2024-3094"
}

Ask it from an AI agent (MCP)

Add the Apify MCP server with this tool to your MCP client (Claude, Cursor, VS Code, ...); it signs you in with OAuth or Authorization: Bearer <APIFY_TOKEN>. It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

https://mcp.apify.com?tools=bosco_labs/package-vulns

Then ask:

Use the bosco_labs/package-vulns tool to answer: What is CVE-2024-3094 (the xz backdoor) and which versions are affected?

Call the Apify API

Runs the Actor and returns the rows in one request, billed to your Apify account ($0.005 per package version or CVE answered (HTTP API)). It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

curl https://api.apify.com/v2/acts/bosco_labs~package-vulns/run-sync-get-dataset-items \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vulnerabilityId": "CVE-2024-3094"}'

Call the Bosco Labs HTTP API

Bosco Labs HTTP API (beta): same input and rows, $0.005 per package version or CVE answered from prepaid credits. Get a key with a $0.50 free trial, or send the same call without a key and pay per call in USDC via x402 (no account).

curl https://api.boscolabs.dev/v1/package-vulns \
  -H "Authorization: Bearer $BOSCO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"vulnerabilityId": "CVE-2024-3094"}'

Example output

Snapshot taken 2026-11-06, source links in each row. First 1 of 1 rows (snapshot runs stop at 5 rows); long values shortened.

[
  {
    "schema_version": "1",
    "query_type": "vulnerability",
    "ecosystem": null,
    "name": null,
    "version": null,
    "vulnerability_id": "CVE-2024-3094",
    "summary": "CVE-2024-3094: CRITICAL, not in CISA KEV.",
    "vulnerability_count": null,
    "known_exploited": false,
    "max_severity": "CRITICAL",
    "safe_version": null,
    "safe_version_note": null,
    "epss": {
      "cve": "CVE-2024-3094",
      "score": 0.909,
      "percentile": 0.99808,
      "date": "2026-11-06",
      "source_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-3094"
    },
    "nvd": {
      "cve": "CVE-2024-3094",
      "cvss_score": 10.0,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "cvss_version": "3.1",
      "cwe_ids": [
        "CWE-506"
      ],
      "published": "2024-03-29T17:15:21.150",
      "last_modified": "2026-11-04T22:17:21.430",
      "vuln_status": "Modified",
      "description": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build proc...",
      "source_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"
    },
    "...": "6 more fields"
  }
]

Call it on the HTTP API →All fields and limits