Skip to content
Fencer Vulns
high 7.4

CVE-2026-76844 json

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

published 2026-08-24 2 mo ago modified 2026-10-12 27 d ago also GHSA-g84c-rxfj-3j2c , EUVD-2026-64850

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Patch / fix

  • npm webpack-dev-middleware 7.4.6, 8.3.0
  • zlib Debian 13 1:1.3.dfsg+really1.3.1-1+deb13u1
  • zlib Debian 14 1:1.3.dfsg+really1.3.2-4

debian advisories DEBIAN-CVE-2026-76844

  • zlib Azure Linux 3.0 1.3.2-2

azure linux advisories AZL-105345

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76844 updated cvss 8.6

webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal

  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-controller 4.5.35-1.el9ap, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9 Red Hat build of Apache Camel - HawtIO 4 rhaf-hawtio-maven-repository.zip 4.4.0.GA
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0
    affected: workaround, no fix available
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Fuse 7 webpack-dev-middleware 2.0.6
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    affected: workaround, no fix available
show 17 more
  • Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Data Grid 8.6.3
    fixed: vendor fix RHSA-2026:69296
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 3.4 rhoai/odh-feature-server-rhel9 1792685074
    fixed: vendor fix RHSA-2026:92510
  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    not affected: inline mitigations already exist
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle
    not affected: component not present
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8 Red Hat AMQ Broker 7 amq-broker-bin.zip 7.14.1.CR2, amq-broker-maven-repository.zip 7.14.1.CR3
    not affected: vulnerable code not present
  • Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.13-1.el9ap, automation-gateway 2.5.20260824-1.el8ap, automation-eda-controller 1.0.10-0.1.20260317.git9cae940.el8ap Red Hat build of Apache Camel for Spring Boot 4 rhaf-camel-spring-boot-maven-repository.zip 4.18.1.CS4, rhaf-camel-for-springboot-maven-repository.zip 3.5.16.CS2
    not affected: component not present
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Developer Hub 1 rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki, +1 more Red Hat Discovery 2 discovery/discovery-server-rhel9 1788205779
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-loki, grafana-mssql, +13 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, dotnet6.0, dotnet7.0, dotnet-host, +22 more Red Hat Enterprise Linux 10 pcs 0.12.0-3.el10_0.5, grafana 10.2.6-28.el10_2.4 Red Hat Hardened Images grafana12.4 12.4.9-0.2.hum1, grafana13.1 13.1.3-0.2.hum1, grafana13.2 13.2.0-0.1.1.hum1, prometheus3.13 3.13.2-0.2.hum1 Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-openvpn-rhel8 1789447887, rhmtc/openshift-migration-registry-rhel8 1789447846, rhmtc/openshift-migration-rhel8-operator 1789546352, rhmtc/openshift-migration-operator-bundle 1789546820, rhmtc/openshift-migration-controller-rhel8 1789377223, rhmtc/openshift-migration-log-reader-rhel8 1789375331, +4 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1792697253, rhoai/odh-mlflow-rhel9 1793002327, rhoai/odh-autorag-rhel9 1793265800, rhoai/odh-trainer-rhel9 1792817113, +99 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9 Red Hat OpenShift GitOps openshift-gitops-argocd-cli 1.19.2-36.el9
    not affected: vulnerable code not in execute path
  • Red Hat Quay 3 quay/quay-rhel8
    not affected: vulnerable code not present
  • Red Hat Satellite 6 tfm-rubygem-rabl
    not affected: component not present
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gist.github.com https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm webpack-dev-middleware
>=8.0.0, <8.3.0
<7.4.6
8.3.0
7.4.6

Affected products

  • zlib zlib

Classification

Weakness
  • CWE-787 Out-of-bounds Write
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.