CVE-2026-27171

>= 1.2.12 and < 1.3.2

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a

2.9LOW

CVE-2026-22184

<= 1.3.1.2

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The v

7.8HIGH

CVE-2023-6992

< 2023-11-16

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implem

4.0MEDIUM

CVE-2023-45853

< 1.3.1

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long

9.8CRITICAL

CVE-2022-37434

<= 1.2.12

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra fie

9.8CRITICAL

CVE-2018-25032

>= 1.2.2.2 and < 1.2.12

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

7.5HIGH

CVE-2016-9843

>= 1.2.0 and < 1.2.9

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors inv

9.8CRITICAL

CVE-2016-9842

>= 1.2.3.4 and < 1.2.9

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors

8.8HIGH

CVE-2016-9841

>= 1.2.0 and < 1.2.9

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmet

9.8CRITICAL

CVE-2016-9840

>= 1.2.0.6 and < 1.2.9

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithme

8.8HIGH

CVE-2015-1191

all versions

Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathn

CVE-2013-0296

<= 2.2.4-1

Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's per

CVE-2005-1849

all versions

inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes

CVE-2005-2096

all versions

zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an i

CVE-2004-0797

all versions

The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause

CVE-2003-0107

all versions

Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated

CVE-2002-0059

<= 1.1.3

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to rele

9.8CRITICAL