Log in Start free

Vulnerability · Published Mar 5, 2026 · Assigned by CPANSec

CVE-2026-3381Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

Critical 9.8

In plain English

A critical-severity security flaw in Compress::Raw::Zlib from PMQS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20perl-compress-raw-zlib2.222-r0ALPINE-CVE-2026-3381
Alpine:v3.21perl-compress-raw-zlib2.222-r0ALPINE-CVE-2026-3381
Alpine:v3.22perl-compress-raw-zlib2.222-r0ALPINE-CVE-2026-3381
Alpine:v3.23perl-compress-raw-zlib2.222-r0ALPINE-CVE-2026-3381
Alpine:v3.24perl-compress-raw-zlib2.222-r0ALPINE-CVE-2026-3381
Debian:12libcompress-raw-zlib-perl2.011-2DEBIAN-CVE-2026-3381
Debian:13libcompress-raw-zlib-perl2.011-2DEBIAN-CVE-2026-3381
Debian:14libcompress-raw-zlib-perl2.011-2DEBIAN-CVE-2026-3381

Affected products (as reported)

VendorProductVersions
PMQS Compress::Raw::Zlib 0 – through 2.219

Weakness: CWE-1395 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References