CVE-2026-3381

Received Received - Intake

Insecure zlib Versions in Compress::Raw::Zlib for Perl

Publication date: 2026-03-05

Last updated on: 2026-03-18

Assigner: CPANSec

Description

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-05

Last Modified

2026-03-18

Generated

2026-07-06

AI Q&A

2026-03-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3381

EUVD

EUVD-2026-9520

Affected Vendors & Products

Vendor	Product	Version / Range
pmqs	compress	to 2.219 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

The vulnerability involves Compress::Raw::Zlib versions through 2.219 for Perl, which include potentially insecure versions of the zlib library. This means that these versions of Compress::Raw::Zlib use an outdated or vulnerable zlib implementation that may have security issues.

Impact Analysis

Using Compress::Raw::Zlib versions through 2.219 may expose applications to security risks due to the inclusion of insecure versions of the zlib library. This could potentially lead to exploitation of vulnerabilities present in the older zlib versions, affecting the security and stability of applications relying on this module.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade Compress::Raw::Zlib to version 2.220 or later, which includes zlib 1.3.2 that addresses the security issues found in earlier versions.

Hi! I’m here to help you understand CVE-2026-3381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70