CVE-2023-6992

Memory corruption issues is Cloudflare zlib implementation

State: Published
Severity: 4.0 Medium
Published: Jan 4, 2024
Updated: Sep 6, 2024
Reserved: Dec 20, 2023

Description

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Scores

CVSS	Score	Vector	Source
3.1	4.0 Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L	cloudflare

Weaknesses

CWE-20 Improper Input Validation
CWE-122 Heap-based Buffer Overflow
CWE-126 Buffer Over-read

Affected Products

Product	Versions
zlibCloudflare	before 8352d10Affected

References

https://github.com/cloudflare/zlibproduct
https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqhvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.