CVE-2026-4176

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-4176 affects Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, and from 5.43.0 before 5.43.9. The vulnerability stems from a vulnerable version of the Compress::Raw::Zlib module, which is bundled as a dual-life core module in the Perl package. This module vendors a version of zlib containing multiple vulnerabilities, including CVE-2026-3381 and CVE-2026-27171. The issue was addressed by updating Compress::Raw::Zlib to version 2.221 in Perl's blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94. The vulnerability has a CVSS v3.1 base score of 9.8.

Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Advisories recommend updating to patched Perl releases such as 5.40.4, 5.42.2-RC1, or 5.43.9, which incorporate the fixed Compress::Raw::Zlib version 2.221. Relevant announcements are available via MetaCPAN security lists and release changes for Compress-Raw-Zlib 2.221, perl-5.40.4, and perl-5.42.2. The upstream fix is detailed in the Perl GitHub commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.