Loading story…
Perl disclosed CVE-2026-4176, a vulnerability affecting releases from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, and from 5.43.0 before 5.43.9, because they shipped a vulnerable bundled version of the dual-life core module Compress::Raw::Zlib. The issue traces to the module’s vendored zlib copy, which is vulnerable to CVE-2026-3381 and includes additional flaws such as CVE-2026-27171. Some operating system distributions may avoid exposure if they link Perl against a patched system zlib version 1.3.2 or later, or if they have backported fixes.
The Perl project updated the bundled module in blead to version 2.221 and shipped fixes in Perl 5.40.4 and Perl 5.42.2, which include Compress::Raw::Zlib 2.222. Follow-up discussion on the oss-sec mailing list clarified that remediation guidance should explicitly state that affected installations can also be fixed by installing Compress::Raw::Zlib 2.222 from CPAN so it overrides the vulnerable core module in @INC; earlier guidance had noted 2.220 or later as a workaround.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-30, the CVE record for CVE-2026-4176 was updated to include a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and an Openwall oss-security reference. This expanded the public vulnerability metadata beyond the initial disclosure and remediation details.
A follow-up oss-sec discussion noted that any affected Perl version can be remediated by installing Compress::Raw::Zlib 2.222 from CPAN so it overrides the vulnerable core module. The reply also reiterated that Perl 5.40.4 and 5.42.2 or later include the fixed module.
An oss-sec disclosure reported that Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, and from 5.43.0 before 5.43.9 were affected because they shipped a vulnerable bundled Compress::Raw::Zlib.
Perl released stable versions 5.40.4 and 5.42.2 including Compress::Raw::Zlib 2.222 as the fix for CVE-2026-4176. The issue affected Perl release lines that bundled vulnerable Compress::Raw::Zlib versions.
The Perl project updated the bundled dual-life core module Compress::Raw::Zlib in blead to version 2.221 to address the vulnerable vendored zlib copy implicated in CVE-2026-4176.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security advisories disclosed **CVE-2024-14031** and **CVE-2024-14030** in the Perl packages **`Sereal::Encoder`** and **`Sereal::Decoder`**, affecting versions **4.000 through 4.009_002**. Both modules embed a vulnerable version of the **Zstandard (`zstd`)** library and inherit **CVE-2019-11922**, a buffer overwrite flaw in one-pass compression functions present in zstd versions prior to **1.3.8**. The underlying issue is a race condition that can trigger **out-of-bounds writes** when an undersized output buffer is used, and the advisories classify the exposure as **CWE-1395: dependency on a vulnerable third-party component**. Maintainers advised users to upgrade both Perl modules to **version 4.010 or later** to remove the vulnerable bundled library.
Jun 29, 2026
A malicious backdoor was discovered in **XZ Utils**, a widely used compression library, and assigned **`CVE-2024-3094`**, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions **5.6.0** and **5.6.1** and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected `liblzma` packages, particularly where `sshd` was linked through `systemd` integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems. The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as **`CVE-2021-44228`** in **Apache Log4j**. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Jul 12, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026