CVE-2026-4176

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.

Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
SHAY	perl	>= 5.9.4, < 5.40.4-RC1; >= 5.41.0, < 5.42.2-RC1; >= 5.43.0, < 5.43.9

References

https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94Patch
https://lists.security.metacpan.org/cve-announce/msg/37638919/Third Party Advisory
https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/ChangesRelease Notes
https://metacpan.org/release/SHAY/perl-5.40.4/changesRelease Notes
https://metacpan.org/release/SHAY/perl-5.42.2/changesRelease Notes
https://www.cve.org/CVERecord?id=CVE-2026-3381Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/30/2Mailing List, Third Party Advisory

Timeline

Published: Mar 29, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41779.1YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in t CVE-2026-41796.1Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.CVE-2026-41809.8A vulnerability was identified in D-Link DIR-816 1.10CNB05. The impacted element is an unknown function of the file redirect.asp of the comp CVE-2026-41819.8A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi CVE-2026-41829.8A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi o CVE-2026-41839.8A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSe CVE-2026-418375.3Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider J CVE-2026-418387.5IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combi CVE-2026-418394.2A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation CVE-2026-41849.8A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/for CVE-2026-418405.9Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring CVE-2026-418415.9Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Sp