Vulnerability in SHAY perl

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.8

[ Description ]Official description

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0448

  Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch

  Probability/damage H/HCVE-2026-54513CVE-2026-56741CVE-2026-59649+191 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4078

  Oracle Fusion Middleware: Multiple vulnerabilities Translated from German

  CVE-2026-91212CVE-2023-43622CVE-2026-42779+191 more CVEs

[ References ]References

• www.cve.org/CVERecordvendor-advisoryrelatedvdb-entry
• lists.security.metacpan.org/cve-announce/msg/37638919vendor-advisory
• github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94patch
• metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changesrelease-notes
• metacpan.org/release/SHAY/perl-5.40.4/changesrelease-notes
• metacpan.org/release/SHAY/perl-5.42.2/changesrelease-notes