{"id":"CVE-2026-4176","summary":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib","details":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.","modified":"2026-07-15T01:49:18.317858923Z","published":"2026-03-29T20:50:51.058Z","related":["CGA-ppv9-mjqf-c9x4"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4176.json","cna_assigner":"CPANSec","cwe_ids":["CWE-1395"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/30/2"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4176.json"},{"type":"ADVISORY","url":"https://lists.security.metacpan.org/cve-announce/msg/37638919/"},{"type":"ADVISORY","url":"https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes"},{"type":"ADVISORY","url":"https://metacpan.org/release/SHAY/perl-5.40.4/changes"},{"type":"ADVISORY","url":"https://metacpan.org/release/SHAY/perl-5.42.2/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-3381"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94"},{"type":"PACKAGE","url":"https://github.com/Perl/perl5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perl/perl5","events":[{"introduced":"27e0a6173cfa04e70f8057a8b3a0ceb668a33dbc"},{"fixed":"d935eee08874ebc66b5e0ffea91fa1440a189bc3"},{"introduced":"e8cce44acbf725a386d6645647073769caab1f34"},{"fixed":"b62845c7186b0b6a8e4e83419e6b5ef64ceef3ed"},{"introduced":"1d7f1a41a11375afc3ef8599bf5b4bd367019ba9"},{"fixed":"c25e30926ee2a7bf475baeda3c1b97cc56803f94"},{"fixed":"c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.9.4"},{"fixed":"5.40.4"},{"introduced":"5.41.0"},{"fixed":"5.42.2"},{"introduced":"5.43.0"},{"fixed":"5.43.9"}]}}],"versions":["v5.42.2-RC1","v5.40.4-RC1","v5.42.1","v5.42.1-RC1","v5.43.8","v5.42.0","v5.43.6","v5.43.2","v5.40.3","v5.40.3-RC1","v5.43.1","v5.43.0","v5.42.0-RC3","v5.42.0-RC2","v5.42.0-RC1","v5.41.13","v5.41.12","v5.41.11","v5.40.2","v5.40.2-RC1","v5.41.10","v5.41.9","v5.41.8","v5.40.1","v5.40.1-RC1","v5.41.7","v5.41.5","v5.41.4","v5.41.3","v5.40.0","v5.41.2","v5.41.1","v5.41.0","v5.40.0-RC2","v5.40.0-RC1","v5.39.8","v5.39.7","v5.39.5","v5.39.4","v5.38.0","v5.39.3","v5.39.1","v5.39.0","v5.38.0-RC2","v5.38.0-RC1","v5.37.11","v5.37.10","v5.37.9","v5.37.7","v5.37.6","v5.37.5","v5.37.4","v5.37.3","v5.37.2","v5.37.1","v5.36.0","v5.37.0","v5.36.0-RC3","v5.35.11","v5.35.10","v5.34.0","v5.35.9","v5.35.8","v5.35.6","v5.35.5","v5.35.3","v5.35.0","v5.34.0-RC2","v5.34.0-RC1","v5.33.9","v5.33.8","v5.33.7","v5.32.0","v5.33.4","v5.33.3","v5.33.2","v5.33.1","v5.33.0","v5.32.0-RC1","v5.31.11","v5.31.7","v5.31.5","v5.30.0","v5.31.4","v5.31.3","v5.31.2","v5.31.1","v5.31.0","v5.30.0-RC2","v5.30.0-RC1","v5.29.10","v5.29.9","v5.29.8","v5.29.7","v5.29.6","v5.29.5","v5.28.0","v5.29.1","v5.29.0","v5.28.0-RC4","v5.28.0-RC3","v5.28.0-RC2","v5.28.0-RC1","v5.27.11","v5.27.10","v5.27.8","v5.27.7","v5.27.6","v5.27.5","v5.27.3","v5.26.0","v5.27.0","v5.26.0-RC2","v5.25.11","v5.25.9","v5.25.7","v5.25.5","v5.25.4","v5.25.3","v5.24.0","v5.25.2","v5.25.0","v5.24.0-RC5","v5.24.0-RC4","v5.24.0-RC3","v5.24.0-RC2","v5.24.0-RC1","v5.23.7","v5.23.6","v5.23.4","v5.23.3","if-0.0605","v5.23.2","v5.23.1","v5.23.0","v5.22.0","v5.22.0-RC2","v5.22.0-RC1","v5.21.11","if-0.0604","v5.21.10","v5.21.9","v5.21.8","v5.21.6","v5.21.5","v5.21.4","v5.21.1","v5.21.0","v5.20.0","v5.20.0-RC1","v5.19.11","v5.19.7","v5.19.5","v5.19.3","v5.19.2","if-0.0603","v5.19.1","v5.18.0","v5.19.0","v5.18.0-RC4","v5.18.0-RC3","v5.18.0-RC2","v5.18.0-RC1","v5.17.9","v5.17.8","v5.17.7.0","v5.17.7","v5.17.6","v5.17.4","v5.17.2","v5.17.0","v5.16.0","v5.16.0-RC2","v5.16.0-RC1","v5.15.9","v5.15.5","v5.15.4","v5.15.3","v5.15.2","v5.15.1","v5.15.0","v5.14.0","v5.14.0-RC3","v5.14.0-RC2","v5.14.0-RC1","v5.13.11","v5.13.10","v5.13.9","v5.13.8","v5.13.7","v5.13.6","v5.13.5","v5.13.4","v5.13.3","v5.13.2","v5.13.1","v5.12.0","v5.13.0","v5.12.0-RC5","v5.12.0-RC4","v5.12.0-RC3","v5.12.0-RC2","v5.12.0-RC1","v5.12.0-RC0","v5.11.5","v5.11.4","v5.11.3","v5.11.1","v5.11.0","GitLive-blead","v5.10.0","perl-5.9.5","perl-5.9.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4176.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}