Compress::Raw::Zlib is bundled with the Perl interpreter as a core module. The vendored copy of zlib that it uses contains several known vulnerabilities, including CVE‑2026‑3381. When the module processes specially crafted compressed data, it can execute arbitrary code in the context of the running Perl interpreter, potentially compromising the entire system.

Perl releases from 5.9.4 up to 5.40.3, from 5.41.0 up to 5.42.1 and from 5.43.0 up to 5.43.8 distribute the vulnerable module. These versions are shipped by SHAY. The issue was fixed in Perl 5.40.4, 5.42.2 and 5.43.9, which ship Compress::Raw::Zlib 2.222. Some operating‑system distributors rebuild Perl to link against the system zlib; if their zlib library is version 1.3.2 or newer or has relevant patches, the vulnerability may not apply.

The CVSS score of 9.8 indicates a high impact if the flaw is exploited. The EPSS score of less than 1 % reflects current evidence of exploitation activity but does not diminish the risk; it still warrants prompt remediation. Because the vulnerability is not listed in the CISA KEV catalog, it may not be catalogued as a known exploited vulnerability yet, but the high severity warrants attention. Attackers could potentially provide crafted compressed input to any Perl process, whether executed locally or through a networked service that runs Perl code.