Vulnerability-Lookup

CVE-2026-76844 (GCVE-0-2026-76844)

Vulnerability from cvelistv5 – Published: 2026-08-24 13:12 – Updated: 2026-10-01 11:03

Title

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

Summary

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:22 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

5 references

URL	Tags
https://gist.github.com/thesmartshadow/e0b9481792…	technical-descriptionexploit
https://github.com/madler/zlib/commit/df84af25dc1…	patch
https://github.com/madler/zlib/blob/v1.3.2/gzwrit…	technical-description
https://github.com/madler/zlib	product
https://www.vulncheck.com/advisories/zlib-1.3.1.2…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
zlib	zlib	Affected: 1.2.11 , ≤ 1.3.2 (custom) cpe:2.3:a:zlib:zlib::::::::

Date Public

2026-09-02 00:00

Credits

Ali Firas (thesmartshadow) Michael Mullins

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76844",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:22:33.313523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:22:44.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/madler/zlib",
          "product": "zlib",
          "vendor": "zlib",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3.2",
                  "versionStartIncluding": "1.2.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Firas (thesmartshadow)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Mullins"
        }
      ],
      "datePublic": "2026-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T11:03:59.221Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Technical report and proof of concept",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/madler/zlib"
        },
        {
          "name": "VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "title": "zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76844",
    "datePublished": "2026-08-24T13:12:01.148Z",
    "dateReserved": "2026-08-19T20:34:19.724Z",
    "dateUpdated": "2026-10-01T11:03:59.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-76844",
      "date": "2026-10-16",
      "epss": "0.00592",
      "percentile": "0.47178"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-17T01:43:23.000Z",
      "cve": "CVE-2026-76844",
      "id": "msrc_CVE-2026-76844",
      "initial_release_date": "2026-10-02T01:02:06.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-76844.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:github/madler/zlib",
                "product": "zlib",
                "vendor": "zlib",
                "versions": [
                  {
                    "lessThanOrEqual": "1.3.2",
                    "status": "affected",
                    "version": "1.2.11",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
          },
          {
            "lang": "es",
            "value": "zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de b\u00fafer de mont\u00f3n: despu\u00e9s de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dej\u00e1ndolo apuntando al b\u00fafer del llamador. Una llamada posterior de escritura gz entonces deriva una posici\u00f3n a partir del puntero obsoleto y escribe m\u00e1s all\u00e1 de una asignaci\u00f3n de mont\u00f3n; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr()."
          }
        ],
        "id": "CVE-2026-76844",
        "lastModified": "2026-10-12T17:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.2,
              "source": "disclosure@vulncheck.com",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-76844",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:22:33.313523Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-24T14:17:02.250",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-15T10:39:49+00:00",
      "cve": "CVE-2026-76844",
      "id": "CVE-2026-76844",
      "initial_release_date": "2026-08-24T13:12:01.148000+00:00",
      "product_status:fixed": "4",
      "product_status:known_affected": "25",
      "product_status:known_not_affected": "102",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-76844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-01T16:18:03Z",
      "cve": "CVE-2026-76844",
      "id": "CVE-2026-76844",
      "initial_release_date": "2026-08-27T16:50:25Z",
      "product_status:known_affected": "15",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-76844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-76844.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-76844",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-26T18:22:33.313523Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-26T18:22:40.939Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:github/madler/zlib",
              "product": "zlib",
              "vendor": "zlib",
              "versions": [
                {
                  "lessThanOrEqual": "1.3.2",
                  "status": "affected",
                  "version": "1.2.11",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "1.3.2",
                      "versionStartIncluding": "1.2.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Ali Firas (thesmartshadow)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Michael Mullins"
            }
          ],
          "datePublic": "2026-09-02T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "HIGH"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-01T11:03:59.221Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "Technical report and proof of concept",
              "tags": [
                "technical-description",
                "exploit"
              ],
              "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
            },
            {
              "name": "Patch Commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/madler/zlib"
            },
            {
              "name": "VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
            }
          ],
          "title": "zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-76844",
        "datePublished": "2026-08-24T13:12:01.148Z",
        "dateReserved": "2026-08-19T20:34:19.724Z",
        "dateUpdated": "2026-10-01T11:03:59.221Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-76844

Vulnerability from fkie_nvd - Published: 2026-08-24 14:17 - Updated: 2026-10-12 17:10

Severity

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
	disclosure@vulncheck.com	https://github.com/madler/zlib
	disclosure@vulncheck.com	https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
	disclosure@vulncheck.com	https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/madler/zlib",
          "product": "zlib",
          "vendor": "zlib",
          "versions": [
            {
              "lessThanOrEqual": "1.3.2",
              "status": "affected",
              "version": "1.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
    },
    {
      "lang": "es",
      "value": "zlib 1.2.11 hasta 1.3.2 contiene un desbordamiento de b\u00fafer de mont\u00f3n: despu\u00e9s de que falle una llamada subyacente a write(), gz_write() retorna sin restablecer strm.next_in, dej\u00e1ndolo apuntando al b\u00fafer del llamador. Una llamada posterior de escritura gz entonces deriva una posici\u00f3n a partir del puntero obsoleto y escribe m\u00e1s all\u00e1 de una asignaci\u00f3n de mont\u00f3n; cualquier fallo de write() lo alcanza, incluyendo EPIPE en un descriptor de bloqueo, y en versiones anteriores a la 1.3.1.2 la escritura fallida debe ir seguida de una llamada a gzclearerr()."
    }
  ],
  "id": "CVE-2026-76844",
  "lastModified": "2026-10-12T17:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "disclosure@vulncheck.com",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-76844",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T18:22:33.313523Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-24T14:17:02.250",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Primary"
    }
  ]
}

GHSA-G84C-RXFJ-3J2C

Vulnerability from github – Published: 2026-09-29 16:59 – Updated: 2026-09-29 16:59

Summary

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Details

[!IMPORTANT] CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA.

Impact

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl. When the configured publicPath has no trailing slash (for example /assets), a request that shares that prefix without being under it (for example /assets../secret) still passes the containment check, and the .. guard does not catch it because it runs on the path before the publicPath prefix is stripped. The stripped remainder then escapes the configured output directory once joined, so an unauthenticated request can read files outside the output root. Applications serving webpack-dev-middleware (directly or via webpack-dev-server) with a publicPath that does not end in a slash are affected. A development server reachable on the network can be attacked with a single request and no victim interaction.

Patches

Patched in webpack-dev-middleware 8.3.0. There is no backport to the 5.x, 6.x, or 7.x lines; users on those lines should upgrade to 8.3.0 or later.

Workarounds

Configure publicPath with a trailing slash (for example /assets/ instead of /assets), or upgrade to a patched version.

References

CVE-2024-29180 (GHSA-wr3j-pwj9-hqq6), the earlier path traversal in the same component that this issue bypasses.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "webpack-dev-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 7.4.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "webpack-dev-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T16:59:18Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "\u003e [!IMPORTANT]\n\u003e CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were notified before publication, and no fix was available at that time. This advisory is the coordinated record produced by the webpack maintainers and the OpenJS Foundation CNA.\n\n### Impact\n\n`webpack-dev-middleware` resolves a request to a local file in `getFilenameFromUrl`. When the configured `publicPath` has no trailing slash (for example `/assets`), a request that shares that prefix without being under it (for example `/assets../secret`) still passes the containment check, and the `..` guard does not catch it because it runs on the path before the `publicPath` prefix is stripped. The stripped remainder then escapes the configured output directory once joined, so an unauthenticated request can read files outside the output root. Applications serving `webpack-dev-middleware` (directly or via `webpack-dev-server`) with a `publicPath` that does not end in a slash are affected. A development server reachable on the network can be attacked with a single request and no victim interaction.\n\n### Patches\n\nPatched in `webpack-dev-middleware` 8.3.0. There is no backport to the 5.x, 6.x, or 7.x lines; users on those lines should upgrade to 8.3.0 or later.\n\n### Workarounds\n\nConfigure `publicPath` with a trailing slash (for example `/assets/` instead of `/assets`), or upgrade to a patched version.\n\n### References\n\n- [CVE-2024-29180](https://www.cve.org/CVERecord?id=CVE-2024-29180) ([GHSA-wr3j-pwj9-hqq6](https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6)), the earlier path traversal in the same component that this issue bypasses.",
  "id": "GHSA-g84c-rxfj-3j2c",
  "modified": "2026-09-29T16:59:18Z",
  "published": "2026-09-29T16:59:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/pull/2404"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/webpack/webpack-dev-middleware"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath"
}

GHSA-P3F5-W63M-MXPH

Vulnerability from github – Published: 2026-08-24 15:31 – Updated: 2026-09-29 16:59

Withdrawn 2026-09-29

Summary

Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references.

Original Description

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(./${pathname}), only matches ".." that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment "assets.." and so passes the guard, but the offset slice cuts within that segment and hands "../.env" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of "auto" resolves to "/" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 7.4.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "webpack-dev-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T16:59:08Z",
    "nvd_published_at": "2026-08-24T14:17:02Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-g84c-rxfj-3j2c. This link is maintained to preserve external references.\n\n## Original Description\nwebpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UP_PATH_REGEXP applied to path.normalize(`./${pathname}`), only matches \"..\" that stands as a whole path segment, while the containment test is the string comparison pathname.startsWith(publicPathPathname) and the file path is built as path.join(outputPath, pathname.slice(publicPathPathname.length)). When the configured publicPath has no trailing slash, a request such as GET /assets../.env against publicPath /assets yields the pathname /assets../.env, whose only dot-dot sits inside the segment \"assets..\" and so passes the guard, but the offset slice cuts within that segment and hands \"../.env\" to path.join, resolving one directory above outputPath. Reading a file from that path requires the middleware to be backed by the physical filesystem, which happens when writeToDisk is true or a custom outputFileSystem is supplied, since the default memfs volume holds only build output. Traversal depth is limited to a single directory because a separately delimited dot-dot segment is collapsed during URL parsing before the guard runs. The default publicPath value of \"auto\" resolves to \"/\" and is not affected. This is an incomplete fix for CVE-2024-29180: the guard and offset slice were introduced by that fix and are present in every release from 5.3.4, 6.1.2 and 7.1.0 onward.",
  "id": "GHSA-p3f5-w63m-mxph",
  "modified": "2026-09-29T16:59:08Z",
  "published": "2026-08-24T15:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76844"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/webpack/webpack-dev-middleware"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",
  "withdrawn": "2026-09-29T16:59:08Z"
}

MSRC_CVE-2026-76844

Vulnerability from csaf_microsoft - Published: 2026-10-02 01:02 - Updated: 2026-10-02 01:02

Summary

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

Scope

1 vulnerability in this advisory, including CVE-2026-76844.

CVE-2026-76844

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Known affected: 1 product

Open the full advisory

RHSA-2026:61783

Vulnerability from csaf_redhat - Published: 2026-08-31 21:39 - Updated: 2026-10-16 23:22

Summary

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Severity

Important

Scope

42 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one directory above the intended output path. This could lead to information disclosure if the middleware is configured to use the physical filesystem.

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 2 products Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:61783

Open the full advisory

RHSA-2026:68681

Vulnerability from csaf_redhat - Published: 2026-09-17 14:19 - Updated: 2026-10-17 05:08

Summary

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update

Severity

Important

Scope

34 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 1 product Known not affected: 10 products

https://access.redhat.com/errata/RHSA-2026:68681

Open the full advisory

RHSA-2026:69296

Vulnerability from csaf_redhat - Published: 2026-09-21 12:19 - Updated: 2026-10-16 17:34

Summary

Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-76844.

CVE-2026-76844

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:69296

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-76844 (GCVE-0-2026-76844)

FKIE_CVE-2026-76844

GHSA-G84C-RXFJ-3J2C

Impact

Patches

Workarounds

References

GHSA-P3F5-W63M-MXPH

Duplicate Advisory

Original Description

MSRC_CVE-2026-76844

RHSA-2026:61783

RHSA-2026:68681

RHSA-2026:69296

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour