CVE-2026-4176

The Compress::Raw::Zlib module is delivered as a built-in core module (dual-life core module) in the Perl package and contains its own bundled copy of the zlib library. This bundled version of zlib is vulnerable to CVE-2026-3381 and CVE-2026-27171, which encompass a number of security flaws. The fix consists of updating the built-in Compress::Raw::Zlib module to version 2.221.

A remote attacker, without requiring authentication, can compromise the confidentiality, integrity, and availability of the system — potentially gaining full control over the vulnerable application or system.

Perl should be updated to version 5.40.4-RC1 or later (stable branch), 5.42.2-RC1 or later, or 5.43.9 or later (developer branch). Alternatively, manual update of the Compress::Raw::Zlib module to version 2.221 (commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94) is possible. Details are available in the vendor references.

Perl in versions from 5.9.4 to (excluding) 5.40.4-RC1, from 5.41.0 to (excluding) 5.42.2-RC1, and from 5.43.0 to (excluding) 5.43.9