Perl Compress::Raw::Zlib Vulnerability in Dual-Life Core Module

A vulnerability exists in the Perl dual-life core module Compress::Raw::Zlib, affecting versions from 5.9.4 prior to 5.40.4-RC1, and from 5.41.0 prior to 5.42.2-RC1. The issue arises from a bundled version of zlib that contains multiple vulnerabilities, including those identified in CVE-2026-27171. This vulnerability in zlib was highlighted in a 7ASecurity audit. The problem has been addressed in Compress::Raw::Zlib version 2.220, which is included in Perl 5.40.4-RC1 and 5.42.2-RC1.

Impact

Exploitation of this vulnerability could lead to the use of insecure zlib functions, potentially allowing for data corruption or manipulation during compression or decompression processes.

Remediation

Users can upgrade to Compress::Raw::Zlib version 2.220 or later to address this vulnerability.