CVE-2026-4176
Critical
Description
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Perl
PublishedMar 29, 2026
First seenMar 29, 2026
Weakness typeCWE-1395CWE-1395
How to fix
Update
- perl perl5.40.4, 5.42.2, 5.43.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| perl perl | 5.9.4 ≤ v < 5.40.4, 5.41.0 ≤ v < 5.42.2, 5.43.0 ≤ v < 5.43.9 | 5.40.4, 5.42.2, 5.43.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.