CVE-2026-4176

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

State: Published
Severity: 9.8 Critical
Published: Mar 29, 2026
Updated: Mar 30, 2026
Reserved: Mar 14, 2026

Read the record on cve.org

Description

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.

Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-1395 Dependency on Vulnerable Third-Party Component

Affected Products

Product	Versions
perlSHAY	5.9.4 to before 5.40.4-RC1Affected 5.41.0 to before 5.42.2-RC1Affected 5.43.0 to before 5.43.9Affected

References

https://www.cve.org/CVERecord?id=CVE-2026-3381vendor-advisoryrelatedvdb-entry
https://lists.security.metacpan.org/cve-announce/msg/37638919/vendor-advisory
https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94patch
https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changesrelease-notes
https://metacpan.org/release/SHAY/perl-5.40.4/changesrelease-notes
https://metacpan.org/release/SHAY/perl-5.42.2/changesrelease-notes
http://www.openwall.com/lists/oss-security/2026/03/30/2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.