Summaryinfo

A vulnerability was found in SHAY perl up to 5.43.8. It has been classified as problematic. Affected by this issue is the function Compress::Raw in the library Compress. Performing a manipulation results in vulnerable third-party component. This vulnerability is known as CVE-2026-4176. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in SHAY perl up to 5.43.8. This affects the function Compress::Raw in the library Compress. The manipulation with an unknown input leads to a vulnerable third-party component vulnerability. CWE is classifying the issue as CWE-1395. The product has a dependency on a third-party component that contains one or more known vulnerabilities. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

This vulnerability is uniquely identified as CVE-2026-4176 since 03/14/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 304367 (Linux Distros Unpatched Vulnerability : CVE-2026-4176), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.40.4-RC1, 5.42.2-RC1 or 5.43.9 eliminates this vulnerability. Applying the patch c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (304367) and EUVD (EUVD-2026-17044). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• SHAY

Name

• perl

Version

• 5.43.0
• 5.43.1
• 5.43.2
• 5.43.3
• 5.43.4
• 5.43.5
• 5.43.6
• 5.43.7
• 5.43.8

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion