zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0aee6ab474 advisory.

    Update to 1.3.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ca44fe35a9 advisory.

    Update to 1.3.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located
    under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not
    affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an
    excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-
    size global buffer. (CVE-2026-22184)

  - zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can
    do right shifts within a loop that has no termination condition. (CVE-2026-27171)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located     under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not     affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an     excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-     size global buffer. (CVE-2026-22184)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301672	Fedora 43 : mingw-zlib (2026-0aee6ab474)	Nessus	Fedora Local Security Checks	medium
301669	Fedora 42 : mingw-zlib (2026-ca44fe35a9)	Nessus	Fedora Local Security Checks	medium
438446	Alpine: multiple zlib packages: security update to 1.3.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
438446	Alpine: multiple zlib packages: security update to 1.3.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
282443	Linux Distros Unpatched Vulnerability : CVE-2026-22184	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-22184

medium

Tenable Plugins

medium

medium

medium

medium

medium