Vulnerability Intelligence Report
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
CVE-2026-4176
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.68%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-1395 ↗CWE-1395 Dependency on Vulnerable Third-Party Component
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SHAY | perl | 5.9.4 < 5.40.4-RC1 (affected), 5.41.0 < 5.42.2-RC1 (affected), 5.43.0 < 5.43.9 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.676%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | CPAN Security Group · Open Source · Canada |
| Reserved | 2026-03-14T16:17:19 |
| Published | 2026-03-29T20:50:51 |
| Last Updated | 2026-03-30T15:35:08 |
Community Chatter & Buzz