zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791832293 advisory.

  - zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write()     returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call     then derives a position from the stale pointer and writes past a heap allocation; any write() failure     reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must     be followed by a gzclearerr() call. (CVE-2026-76844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791916248 advisory.

  - zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write()     returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call     then derives a position from the stale pointer and writes past a heap allocation; any write() failure     reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must     be followed by a gzclearerr() call. (CVE-2026-76844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791915688 advisory.

  - zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write()     returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call     then derives a position from the stale pointer and writes past a heap allocation; any write() failure     reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must     be followed by a gzclearerr() call. (CVE-2026-76844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write()
    returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call
    then derives a position from the stale pointer and writes past a heap allocation; any write() failure
    reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must
    be followed by a gzclearerr() call. (CVE-2026-76844)

ID	Name	Product	Family	Type	Severity
368041	AlmaLinux 9.2 [TuxCare] Security Update: minizip-compat / minizip-compat-devel / zlib / zlib-devel / etc (ALMALINUX9.2:CLSA-2026:1791832293)	Nessus	Alma Linux Local Security Checks	Local	high
365369	CentOS Linux 8.5 [TuxCare] Security Update: zlib / zlib-devel / zlib-static (CENTOS8.5:CLSA-2026:1791916248)	Nessus	CentOS Local Security Checks	Local	high
365365	CentOS Linux 8.4 [TuxCare] Security Update: zlib / zlib-devel / zlib-static (CENTOS8.4:CLSA-2026:1791915688)	Nessus	CentOS Local Security Checks	Local	high
448485	SCA: security update for webpack-dev-middleware (GHSA-g84c-rxfj-3j2c)	Tenable Cloud Security	SCA Checks	Local	high
448485	SCA: security update for webpack-dev-middleware (GHSA-g84c-rxfj-3j2c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-76844

high

Tenable Plugins

high

high

high

high

high