Zlib

This hub aggregates every CVE we track for Zlib, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Zlib.

• CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption9.8Apr 16, 2026
• CVE-2026-3381Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib9.8Mar 5, 2026
• CVE-2026-27171zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.2.9Feb 18, 2026
• CVE-2026-22184zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()7.8Jan 7, 2026
• CVE-2025-0725gzip integer overflow7.3Feb 5, 2025
• CVE-2023-6992Memory corruption issues is Cloudflare zlib implementation4.0Jan 4, 2024
• CVE-2023-45853MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supporte...9.8Oct 14, 2023
• CVE-2022-37434zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected...9.8Aug 5, 2022
• CVE-2018-25032zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.7.5Mar 25, 2022
• BDU:2021-05117Уязвимость библиотеки сжатия zlib операционной системы «Аврора», позволяющая нарушителю вызвать отказ в обслуживании или оказать неопределенное воздействие7.3Oct 27, 2021
• BDU:2021-03228Уязвимость библиотеки сжатия zlib операционной системы «Аврора», связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании или оказать неопределенное воздействие6.2Jun 23, 2021
• CVE-2016-9843The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.9.8May 23, 2017
• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.9.8May 23, 2017
• CVE-2016-9842The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.8.8May 23, 2017
• CVE-2016-9840inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.8.8May 23, 2017