CVE-2026-4176

Name	CVE-2026-4176
Description	Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
perl (PTS)	bullseye	5.32.1-4+deb11u3	fixed
	bullseye (security)	5.32.1-4+deb11u4	fixed
	bookworm	5.36.0-7+deb12u3	fixed
	bookworm (security)	5.36.0-7+deb12u2	fixed
	trixie	5.40.1-6	fixed
	forky, sid	5.40.1-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
perl	source	(unstable)	5.10.0-21

Notes

https://lists.security.metacpan.org/cve-announce/msg/38393284/
Since perl/5.10.0-20 (in experimental) the packaging uses the system zlib library.
The CVE is assigned for the embedded use of zlib to address CVE-2026-27171.