CVE-2026-4176: Perl Compress::Raw::Zlib Vulnerability

CVE-2026-4176 Overview

CVE-2026-4176 is a critical vulnerability affecting multiple versions of Perl that include a vulnerable version of the Compress::Raw::Zlib dual-life core module. The vulnerability stems from a vendored version of zlib bundled within Compress::Raw::Zlib that contains several security issues, including CVE-2026-27171. This supply chain vulnerability exposes Perl applications to potential remote attacks through the compression library.

The Compress::Raw::Zlib module is included in Perl as a dual-life core module, meaning it ships with Perl but can also be installed independently from CPAN. The bundled zlib library's vulnerabilities (tracked separately as CVE-2026-3381) create a transitive security risk for any Perl application utilizing compression functionality.

Critical Impact

Network-accessible vulnerability in Perl's core compression module allows unauthenticated attackers to potentially achieve remote code execution with no user interaction required.

Affected Products

• Perl versions 5.9.4 through 5.40.3 (before 5.40.4-RC1)
• Perl versions 5.41.0 through 5.42.1 (before 5.42.2-RC1)
• Perl versions 5.43.0 through 5.43.8 (before 5.43.9)

Discovery Timeline

• 2026-03-29 - CVE-2026-4176 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4176

Vulnerability Analysis

This vulnerability represents a supply chain security issue where Perl packages a vulnerable third-party library (zlib) within its Compress::Raw::Zlib core module. The underlying vulnerability in the vendored zlib implementation (CVE-2026-27171) is exposed to network-based attacks without requiring authentication or user interaction.

Applications that process compressed data using Perl's native compression modules are exposed to this vulnerability. The attack surface is particularly concerning because compression operations are common in web applications, data processing pipelines, and system utilities written in Perl.

Root Cause

The root cause is the inclusion of an outdated, vulnerable version of zlib bundled within the Compress::Raw::Zlib module (versions prior to 2.221). This vendored library approach, while simplifying distribution, creates a dependency management challenge where security patches in upstream libraries must be manually integrated into downstream packages.

The vulnerability was addressed by updating the bundled Compress::Raw::Zlib to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

Attack Vector

The vulnerability is network-accessible, meaning attackers can exploit it remotely. The attack does not require authentication or privileges, and no user interaction is needed. An attacker could potentially craft malicious compressed data that, when processed by a vulnerable Perl application using Compress::Raw::Zlib, triggers the underlying zlib vulnerability.

The following patch shows the security update applied to Porting/Maintainers.pl:

     },
 
     'Compress::Raw::Zlib' => {
-        'DISTRIBUTION' => 'PMQS/Compress-Raw-Zlib-2.218.tar.gz',
-        'SYNCINFO'     => 'jkeenan on Wed Feb 11 11:27:39 2026',
+        'DISTRIBUTION' => 'PMQS/Compress-Raw-Zlib-2.221.tar.gz',
+        'SYNCINFO'     => 'jkeenan on Fri Feb 27 10:16:27 2026',
         'FILES'    => q[cpan/Compress-Raw-Zlib],
         'EXCLUDED' => [
             qr{^examples/},

Source: GitHub Commit Update

The module version was also updated in cpan/Compress-Raw-Zlib/lib/Compress/Raw/Zlib.pm:

 use bytes ;
 our ($VERSION, $XS_VERSION, @ISA, @EXPORT, %EXPORT_TAGS, @EXPORT_OK, $AUTOLOAD, %DEFLATE_CONSTANTS, @DEFLATE_CONSTANTS);
 
-$VERSION = '2.218';
+$VERSION = '2.221';
 $XS_VERSION = $VERSION;
 $VERSION = eval $VERSION;

Source: GitHub Commit Update

Detection Methods for CVE-2026-4176

Indicators of Compromise

• Check Perl version using perl -v to identify if running vulnerable versions (5.9.4 to 5.40.3, 5.41.0 to 5.42.1, or 5.43.0 to 5.43.8)
• Verify Compress::Raw::Zlib version by running perl -MCompress::Raw::Zlib -e 'print $Compress::Raw::Zlib::VERSION' - versions below 2.221 are vulnerable
• Monitor system logs for unexpected crashes or memory corruption events in Perl processes handling compressed data
• Look for anomalous network traffic patterns targeting applications known to process compressed data with Perl

Detection Strategies

• Implement software composition analysis (SCA) scanning to identify vulnerable Perl versions across your infrastructure
• Use SentinelOne's runtime protection to detect exploitation attempts targeting memory corruption vulnerabilities
• Deploy network intrusion detection rules to identify malicious compressed payloads targeting known zlib vulnerabilities
• Establish baseline behavior monitoring for Perl processes to detect anomalous execution patterns

Monitoring Recommendations

• Enable verbose logging for Perl applications processing external compressed data
• Configure SentinelOne agents to alert on suspicious process behavior from Perl interpreters
• Monitor CPAN security advisories and MetaCPAN announcements for related vulnerabilities
• Track the OpenWall OSS-Security Discussion for emerging threat intelligence

How to Mitigate CVE-2026-4176

Immediate Actions Required

• Upgrade Perl to version 5.40.4-RC1 or later (for 5.40.x branch), 5.42.2-RC1 or later (for 5.42.x branch), or 5.43.9 or later (for 5.43.x branch)
• Alternatively, update Compress::Raw::Zlib independently from CPAN to version 2.221 or later using cpan Compress::Raw::Zlib
• Inventory all systems running Perl and prioritize patching internet-facing applications
• Apply defense-in-depth measures including network segmentation for systems that cannot be immediately patched

Patch Information

The vulnerability has been addressed in the following Perl releases:

• Perl 5.40.4: See MetaCPAN Perl Release Changes for details
• Perl 5.42.2: See MetaCPAN Perl Release Changes for details
• Compress::Raw::Zlib 2.221: See MetaCPAN Release Changes Log for module-specific changes

The fix was implemented in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94. For additional context on the underlying vulnerability, see the CVE-2026-3381 Record.

Workarounds

• If upgrading Perl is not immediately feasible, install the standalone Compress::Raw::Zlib version 2.221 or later from CPAN to override the bundled vulnerable version
• Implement input validation and size limits on compressed data processed by Perl applications
• Consider using alternative compression libraries where possible until systems can be fully patched
• Deploy SentinelOne's runtime protection to detect and block exploitation attempts in production environments

# Update Compress::Raw::Zlib from CPAN to patch the vulnerability
cpan Compress::Raw::Zlib

# Verify the installed version is 2.221 or later
perl -MCompress::Raw::Zlib -e 'print "Compress::Raw::Zlib version: $Compress::Raw::Zlib::VERSION\n"'

# For system-wide Perl upgrade on Debian/Ubuntu
sudo apt update && sudo apt install perl

# For system-wide Perl upgrade on RHEL/CentOS
sudo dnf update perl