Skip to content
OpenAdvisories
Medium RHSA-2026:61625 2 CVEs

Red Hat Security Advisory: gzip security update

Published Sep 1, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 gzip 0:1.13-4.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 gzip-debuginfo 0:1.13-4.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 gzip-debugsource 0:1.13-4.el10_2

Vulnerabilities 2

  • Medium 6.9
    CVE-2026-41992

    Global Buffer Overflow in GNU gzip

    GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across …

    GNU gzip gzip gzip Debian Ubuntu Azure Linux Alpine
  • Low 2.0
    CVE-2026-41991

    Predictable Temporary File in GNU gzip

    GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This …

    GNU gzip gzip gzip Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494158
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61625.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41991
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41991
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41991
  • article
    https://cert.pl/en/posts/2026/04/CVE-2026-41991/
  • article
    https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
  • article
    https://www.gnu.org/software/gzip/
  • report
    https://access.redhat.com/security/cve/CVE-2026-41992
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494159
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41992
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41992
  • article
    https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681