by Kastro
Paper/Archive/CVE-2026-3381

CVE-2026-3381

PMQS Compress::Raw::Zlib — Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

Affected

ProductAffectedFixed inSource
Compress::Raw::Zlib≤ 2.219–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmetacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changesrefzlib.netrefgithub.com/madler/zlibrefgithub.com/madler/zlib/releases/tag/v1.3.2writeup7asecurity.com/blog/2026/02/zlib-7asecurity-auditadvisorycve.org/CVERecord?id=CVE-2026-27171refgithub.com/pmqs/Compress-Raw-Zlib/issues/41