Rule Explorer

Bundled zlib appears to be a pre-1.3.2 version (ZLIB_VERNUM < 0x1320 or ZLIB_VERSION string matches a pre-1.3.2 release such as "1.3.1.2-audit"). Versions prior to zlib 1.3.2 lack the 7ASecurity audit hardening fixes (CVE-2026-3381 / CVE-2026-27171): missing negative-length checks in crc32_combine, uninitialized-memory disclosure in inflateCopy/deflateCopy,

CCVE-2026-27171CVE-2026-3381CWE-1104CWE-908

Vendored copy of zlib at version older than 1.3.2 detected. Versions <= 1.3.1 contain multiple security defects identified by the 7ASecurity audit (CVE-2026-27171, CVE-2026-3381 / CVE-2026-4176 in Perl's Compress::Raw::Zlib): missing NULL/zero-length guard in compress2(), non-thread-safe custom once() pattern in crc32 table init, and size_t-overflow risk in

CCVE-2026-4176CWE-1395