TI-2026-03624 Aliases CVE-2026-4176 GHSA-q2q4-jjp8-f6m3

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0…

MEDIUM 50CWE-1395Published 2026-03-29 · Updated 2026-03-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0074 54th percentileScored 2026-11-07

Fix Partial perl (SHAY): 5.40.4-RC1, 5.42.2-RC1, 5.43.9Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SHAY	perl	5.9.4 to before 5.40.4-RC1; 5.41.0 to before 5.42.2-RC1; 5.43.0 to before 5.43.9	5.40.4-RC1, 5.42.2-RC1, 5.43.9	Patch available	CNA

perl VendorSHAY Affected 5.9.4 to before 5.40.4-RC1; 5.41.0 to before 5.42.2-RC1; 5.43.0 to before 5.43.9 Fixed in 5.40.4-RC1, 5.42.2-RC1, 5.43.9 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:perl:perl::::::::	5.9.4 to before 5.40.4; 5.41.0 to before 5.42.2; 5.43.0 to before 5.43.9	Vulnerable	Perl

cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* Versions 5.9.4 to before 5.40.4; 5.41.0 to before 5.42.2; 5.43.0 to before 5.43.9 Vulnerable ·Perl

Remediation

Fix · CNA perl (SHAY) Fixed in 5.40.4-RC1, 5.42.2-RC1, 5.43.9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix yet

Not affected: 6 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2026-4176
2026-10-03 Alias added: GHSA-q2q4-jjp8-f6m3

References

Patch 1

https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94

Advisory 3

Other 3

TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-05049 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows… CVSS 3.0CRITICAL 9.8
TI-2017-09493 Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl… CVSS 3.0CRITICAL 9.8

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences