Description
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SHAY | perl | 5.9.4 – < 5.40.4-RC1, 5.41.0 – < 5.42.2-RC1, 5.43.0 – < 5.43.9 | 5.40.4-RC1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.10.0-21 | — |
| Debian 13 | perl | 5.10.0-21 | — |
| Debian 12 | perl | 5.10.0-21 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | perl | No fix yet | — |
| Ubuntu Pro 18.04 LTS | perl | No fix yet | — |
| Ubuntu Pro 16.04 LTS | perl | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | perl | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | perl | 5.42.2-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk +6 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | perl +1 | 5.42.2-r0 | — |
Advisories 11
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- NCSC-2026-0448 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 22, 2026
- WID-SEC-2026-4078 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- NCSC-2026-0309 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Aug 19, 2026
- WID-SEC-2026-2887 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- NCSC-2026-0256 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 22, 2026
- NCSC-2026-0255 Kwetsbaarheden verholpen in Oracle Commerce Platform NCSC-NL (Netherlands) · Jul 22, 2026
- NCSC-2026-0254 Kwetsbaarheden verholpen in Oracle database producten NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2438 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2434 Oracle TimesTen In-Memory Database: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-0901 Perl: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 26, 2026
References
- https://www.cve.org/CVERecord?id=CVE-2026-3381 vendor-advisory related vdb-entry
- https://lists.security.metacpan.org/cve-announce/msg/37638919/ vendor-advisory
- https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 patch
- https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes release-notes
- https://metacpan.org/release/SHAY/perl-5.40.4/changes release-notes
- https://metacpan.org/release/SHAY/perl-5.42.2/changes release-notes