Critical
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib
Type: advisorySources: OSV
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-3381
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:38 UTC · Revision 1
Source evidence
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib
core-osv · Original sourcePublished 5 Mar 2026, 01:28 UTC
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.
osv:CVE-2026-3381
Complete source record
{
"id": "c36944f80e31a20f9671668c626a60e2ca7509b7be92893f32fcc5c8342bfaff",
"url": "https://osv.dev/vulnerability/CVE-2026-3381",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib",
"summary": "Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.",
"evidence": "osv:CVE-2026-3381",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-3381",
"aliases": [
"CVE-2026-3381"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/madler/zlib",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "da607da739fa6047df13e66a2af6b8bec7c2a498"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "da607da739fa6047df13e66a2af6b8bec7c2a498"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.3.2"
}
]
}
},
{
"repo": "https://github.com/pmqs/compress-raw-zlib",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "417f977e9c7122b62a581278667175593a1efdf0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.219"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:pmqs:compress\\:\\:raw\\:\\:zlib:*:*:*:*:*:perl:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.219"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.3.1.2",
"v1.3.1",
"v1.3",
"v1.2.13",
"v1.2.12",
"v1.2.11",
"v1.2.10",
"v1.2.9",
"v1.2.8",
"v1.2.7.3",
"v1.2.7.2",
"v1.2.7.1",
"v1.2.7",
"v1.2.6.1",
"v1.2.6",
"v1.2.5.3",
"v1.2.5.2",
"v1.2.5.1",
"v1.2.5",
"v1.2.4.5",
"v1.2.4.4",
"v1.2.4.3",
"v1.2.4.2",
"v1.2.4.1",
"v1.2.4",
"v1.2.4-pre2",
"v1.2.4-pre1",
"v1.2.3.9",
"v1.2.3.8",
"v1.2.3.7",
"v1.2.3.6",
"v1.2.3.5",
"v1.2.3.4",
"v1.2.3.3",
"v1.2.3.2",
"v1.2.3.1",
"v1.2.3",
"v1.2.2.4",
"v1.2.2.3",
"v1.2.2.2",
"v1.2.2.1",
"v1.2.2",
"v1.2.1.2",
"v1.2.1.1",
"v1.2.1",
"v1.2.0.8",
"v1.2.0.7",
"v1.2.0.6",
"v1.2.0.5",
"v1.2.0.4",
"v1.2.0.3",
"v1.2.0.2",
"v1.2.0.1",
"v1.2.0",
"v1.1.4",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.5",
"v1.0.4",
"v1.0.2",
"v1.0.1",
"v1.0-pre",
"v0.99",
"v0.95",
"v0.94",
"v0.93",
"v0.92",
"v0.91",
"v0.9",
"v0.8",
"v0.79",
"v0.71",
"v2.219",
"v2.218",
"v2.217",
"v2.214",
"v2.213",
"v2.212",
"v2.211",
"v2.209",
"v2.208",
"v2.207",
"v2.206",
"v2.205",
"2.204",
"v2.202",
"v2.201",
"v2.200",
"v2.103",
"v2.101",
"v2.100",
"v2.096",
"v2.095",
"v2.093",
"v2.092",
"v2.091",
"v2.090",
"v2.089",
"v2.088",
"v2.087",
"v2.086",
"v2.084",
"v2.083",
"v2.082",
"v2.081",
"v2.080",
"v2.076",
"v2.075",
"v2.074",
"v2.073",
"v2.072",
"v2.071",
"v2.070",
"v2.069",
"v2.068",
"v2.067",
"v2.066",
"v2.065",
"v2.064",
"v2.063",
"v2.062",
"v2.061",
"v2.060",
"v2.059",
"v2.058",
"v2.057",
"v2.056",
"v2.055",
"v2.054",
"v2.053",
"v2.052",
"v2.051",
"v2.050",
"v2.049",
"v2.048",
"v2.047",
"v2.045",
"v2.044",
"v2.043",
"v2.042",
"v2.040",
"v2.039",
"v2.037",
"v2.036",
"v2.035",
"v2.034",
"v2.033",
"v2.032",
"v2.030",
"v2.029",
"v2.028",
"v2.027",
"v2.026",
"v2.025",
"v2.024",
"v2.023",
"v2.021",
"v2.020",
"v2.019",
"v2.018",
"v2.017",
"v2.015",
"v2.014",
"v2.012",
"v2.011",
"v2.010",
"v2.009",
"v2.008",
"v2.006",
"v2.005",
"v2.004",
"v2.003",
"v2.002",
"v2.001",
"v2.000_14",
"v2.000_13",
"v2.000_12",
"v2.000_11",
"v2.000_09"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3381.json"
}
}
],
"modified": "2026-10-28T02:30:22.421642258Z",
"provider": "osv",
"references": [
"https://cpan.org/modules",
"https://www.zlib.net/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3381.json",
"https://github.com/madler/zlib/releases/tag/v1.3.2",
"https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes",
"https://nvd.nist.gov/vuln/detail/CVE-2026-3381",
"https://www.cve.org/CVERecord?id=CVE-2026-27171",
"https://github.com/pmqs/Compress-Raw-Zlib/issues/41",
"https://github.com/madler/zlib",
"https://github.com/pmqs/Compress-Raw-Zlib",
"https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1395"
],
"cna_assigner": "CPANSec",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3381.json"
}
},
"related_cves": [
{
"value": "CVE-2026-3381",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488674,
"published_at": "2026-03-05T01:28:48.062+00:00"
}