Description
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib.

Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.
Published: 2026-03-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Potential execution or denial of service via vulnerable zlib in Perl module
Action: Immediate Upgrade
AI Analysis

Impact

Compress::Raw::Zlib versions up to 2.219 bundle an old zlib library that contains multiple critical flaws uncovered in a recent security audit. The weaknesses are tied to improper handling of compressed data, allowing an attacker to craft malicious input that could trigger memory corruption, elevate privileges, or cause a crash. The associated weaknesses match CWE-1104 (Untrusted Input Processing), CWE-1284 (Incorrect Cryptographic Storage), and CWE-1395 (Improper Data Validation).

Affected Systems

The vulnerability affects the PMQS Compress::Raw::Zlib Perl module for any application that imports it. All releases through 2.219 are impacted; version 2.220 incorporates zlib 1.3.2, which addresses the documented issues and includes the fix for CVE-2026-27171.

Risk and Exploitability

The CVSS score of 9.8 indicates a high severity risk. The EPSS score is below 1 %, signifying a low but non‑zero likelihood that exploit code exist in the wild; the vulnerability is not listed in the CISA KEV catalog. The exposure is primarily through the module’s decompression routine—an attacker could supply malformed or specially crafted compressed data to trigger the underlying zlib bugs. Based on the description, the attack vector is inferred to be the handling of user‑supplied compressed streams in Perl applications that use this module.

Generated by OpenCVE AI on April 16, 2026 at 05:40 UTC.

Remediation

Vendor Solution

Upgrade to Compress::Raw::Zlib 2.220 or later.

OpenCVE Recommended Actions

  • Upgrade Compress::Raw::Zlib to version 2.220 or later, which includes zlib 1.3.2 and the 7ASecurity audit fixes.
  • Re‑evaluate all Perl code that uses Compress::Raw::Zlib to ensure it only processes data from trusted sources, and implement input validation or integrity checks on compressed payloads.
  • Remain monitoring the vendor’s release channel for additional patches or advisories, and review the security audit reports for guidance on hardening usage patterns.

Generated by OpenCVE AI on April 16, 2026 at 05:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 18 Mar 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Pmqs compress\
Weaknesses CWE-1284
CPEs cpe:2.3:a:pmqs:compress\:\:raw\:\:zlib:*:*:*:*:*:perl:*:*
Vendors & Products Pmqs compress\

Sat, 07 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 07 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
References

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Pmqs
Pmqs compress::raw::zlib
Vendors & Products Pmqs
Pmqs compress::raw::zlib

Thu, 05 Mar 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 05 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1104
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

threat_severity

Important

Thu, 05 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
Description Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.
Title Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib
Weaknesses CWE-1395
References

Subscriptions

Pmqs Compress::raw::zlib Compress\
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-03-11T15:00:11.466Z

Reserved: 2026-02-28T09:24:49.085Z

Link: CVE-2026-3381

cve-icon Vulnrichment

Updated: 2026-03-05T16:32:39.592Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-05T02:16:52.267

Modified: 2026-03-18T19:26:39.577

Link: CVE-2026-3381

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-05T01:28:48Z

Links: CVE-2026-3381 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T05:45:26Z

Weaknesses