Skip to main content

Perl EUVDEUVD-2026-17044

| CVE-2026-4176 CRITICAL
Dependency on Vulnerable Third-Party Component (CWE-1395)
2026-03-29 CPANSec GHSA-q2q4-jjp8-f6m3
Information Disclosure Perl Shay
Critical
Disputed · 9.8 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious compressed data
  2. Exploit
    Send to Perl application using Compress::Raw::Zlib
  3. Execution
    Trigger zlib vulnerability CVE-2026-27171
  4. Impact
    Execute arbitrary code

Vulnerability Assessment

Weakness
CWE
CWE-1395
Exploitation Conditions

Perl versions 5.9.4–5.40.3, 5.41.0–5.42.1, or 5.43.0–5.43.8 with the bundled vulnerable Compress::Raw::Zlib module. Remote unauthenticated attacker can exploit via crafted zlib-compressed data processed by Perl applications using this module. No victim interaction required.
Impact

This vulnerability poses moderate real-world risk. CVSS and EPSS scores are not provided, but the tag 'Information Disclosure' and inherited zlib CVEs suggest impact is limited to data exposure rather than code execution. The SSVC signals are mixed: patch availability (patch is released) reduces urgency, but the bundled nature of Compress::Raw::Zlib in Perl distributions means all affected versions are automatically vulnerable without explicit user action to upgrade the module. The fact that the fix arrived via a vendored zlib update (not new Compress::Raw::Zlib logic) suggests this is a supply-chain risk-users who apply the Perl patch automatically receive the patched zlib-based module. KEV status is unknown, and no public exploit code is referenced. For most Perl users, upgrading to a patched Perl release is straightforward; for others maintaining custom Perl builds, manual CPAN module updates to Compress::Raw::Zlib 2.221 are required.
Exploit ScenarioDerived

An attacker sends crafted compressed data to a Perl application using Compress::Raw::Zlib for decompression. The vulnerable zlib version within Compress::Raw::Zlib mishandles the malformed input, causing information disclosure-e.g., leaking uninitialized memory buffers or internal state. No special authentication is required if the application accepts external compressed input (e.g., a web service decompressing client-supplied gzip data). No public exploit code is referenced; exploitation depends on an application's use of the compression module.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 29, 2026

Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.

RemediationAI

Vendor-released patch: Upgrade to Perl 5.40.4 or later, Perl 5.42.2 or later, or Perl 5.43.9 or later, which bundle Compress::Raw::Zlib 2.221. Alternatively, users on unpatched Perl versions can independently upgrade Compress::Raw::Zlib to version 2.221 from CPAN via 'cpan Compress::Raw::Zlib' or 'perl -MCPAN -e "install Compress::Raw::Zlib"'. For systems with custom Perl builds, ensure zlib dependencies are updated to a non-vulnerable version before rebuilding. Consult https://lists.security.metacpan.org/cve-announce/msg/37638919/ for CPANSec advisories and https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 to verify the upstream fix.

Affected VersionsENISA

perl 5.41.0 <5.42.2-RC1
perl 5.43.0 <5.43.9
perl 5.9.4 <5.40.4-RC1

Affected Packages

euvd perl fix: 5.40.4-RC1, 5.42.2-RC1, 5.43.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Perl distributes Compress::Raw::Zlib as a dual-life core module-maintained both in the Perl source tree and on CPAN as a standalone package. This module wraps zlib, a widely-used compression library. The vulnerability chain stems from CVE-2026-3381 (a zlib flaw) and CVE-2026-27171 (another zlib vulnerability), both of which are inherited when Perl vendors an outdated zlib snapshot. CWE-1395 (Incomplete Reference Counting) indicates the root cause involves improper memory or resource tracking in zlib's handling of compressed data structures. Affected CPE: cpe:2.3:a:shay:perl:*:*:*:*:*:*:*:* covers all Perl versions until patched branches.

Know when Perl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 29, 2026 - 21:15 nvd
Patch available
CVE Published
Mar 29, 2026 - 20:50 nvd
CRITICAL 9.8

DescriptionCVE.org

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.

Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NEWS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Perl

View all
CVE-2012-6329 HIGH POC
7.5 Jan 04

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
CVE-2017-12814 CRITICAL POC
9.8 Sep 28

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
CVE-2015-8608 CRITICAL POC
9.8 Feb 07

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
CVE-2018-18314 CRITICAL POC
9.8 Dec 07

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated

CVE-2018-18312 CRITICAL POC
9.8 Dec 05

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
CVE-2026-13221 CRITICAL POC
9.1 Jul 13

Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized a
CVE-2018-18313 CRITICAL POC
9.1 Dec 07

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
CVE-2016-2381 HIGH
7.5 Apr 08

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CVE-2023-31484 HIGH POC
8.1 Apr 29

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
CVE-2016-6185 HIGH POC
7.8 Aug 02

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
CVE-2018-12015 HIGH POC
7.5 Jun 07

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
CVE-2020-10543 HIGH
8.2 Jun 05

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers

Same weakness CWE-1395 – Dependency on Vulnerable Third-Party Component

View all
CVE-2025-15638 CRITICAL
10.0
CVE-2026-58586 CRITICAL
9.8
CVE-2025-59851 CRITICAL
9.8
CVE-2026-60455 HIGH
8.8
CVE-2026-47906 HIGH
8.6
CVE-2026-114113 HIGH
8.4
CVE-2026-90455 MEDIUM
6.3
CVE-2024-14031 HIGH
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

References

Advisories & patches
PATCH https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 ADVISORY https://lists.security.metacpan.org/cve-announce/msg/37638919/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-4176 ADVISORY https://vuldb.com/vuln/354135 ADVISORY https://www.cve.org/CVERecord?id=CVE-2026-3381 REF http://www.openwall.com/lists/oss-security/2026/03/30/2 REF https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes REF https://metacpan.org/release/SHAY/perl-5.40.4/changes REF https://metacpan.org/release/SHAY/perl-5.42.2/changes

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy