Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2022-37434

critical

CVE-2022-37434

zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field

Published Modified CWE 787, 120
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Azure Linux, CBL-Mariner, Julia, Photon OS. Rated lower by Amazon (high), Red Hat (medium), AlmaLinux (medium), Bottlerocket (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).

Description

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected packages and fixed versions

SourcePackageFixed in
Azure Linux 3.0cloud-hypervisor-cvm, crash, teckit0:38.0.72.2-1.azl3 and 2 more
CBL-Mariner 1.0zlib0:1.2.12-2.cm1
CBL-Mariner 2.0zlib0:1.2.12-2.cm2
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jll, Openresty_jll, Zlib_jll1.27.1+0 and 1 more
Photon OS 2.0zlib1.2.11-3.ph2
Photon OS 3.0zlib1.2.11-3.ph3
Photon OS 4.0zlib, zlib-devel1.2.11-4.ph4
Photon OS 5.0gdb, gdb-minimal13.2-1.ph5
alma 8rsync, rsync-daemon3.1.3-19.el8
alma 9rsync, rsync-daemon, zlib3.2.3-18.el9 and 1 more
alpine 3.11zlib1.2.11-r4
alpine 3.12zlib1.2.12-r2
Show all 172 entries from 63 sources
SourcePackageFixed in
Azure Linux 3.0cloud-hypervisor-cvm0:38.0.72.2-1.azl3
Azure Linux 3.0crash0:8.0.4-2.azl3
Azure Linux 3.0teckit0:2.5.12-4.azl3
CBL-Mariner 1.0zlib0:1.2.12-2.cm1
CBL-Mariner 2.0zlib0:1.2.12-2.cm2
julia::Julia Ecosystem Security AdvisoriesGCCBootstrap_jllno fix listed
julia::Julia Ecosystem Security AdvisoriesOpenresty_jll1.27.1+0
julia::Julia Ecosystem Security AdvisoriesZlib_jll1.2.13+0
Photon OS 2.0zlib1.2.11-3.ph2
Photon OS 3.0zlib1.2.11-3.ph3
Photon OS 4.0zlib1.2.11-4.ph4
Photon OS 4.0zlib-devel1.2.11-4.ph4
Photon OS 5.0gdb13.2-1.ph5
Photon OS 5.0gdb-minimal13.2-1.ph5
alma 8rsync3.1.3-19.el8
alma 8rsync-daemon3.1.3-19.el8
alma 9rsync3.2.3-18.el9
alma 9rsync-daemon3.2.3-18.el9
alma 9zlib1.2.11-32.el9_0
alpine 3.11zlib1.2.11-r4
alpine 3.12zlib1.2.12-r2
alpine 3.13zlib1.2.12-r2
alpine 3.14zlib1.2.12-r2
alpine 3.15zlib1.2.12-r2
alpine 3.16zlib1.2.12-r2
alpine 3.17zlib1.2.12-r2
alpine 3.17zlib-ng2.0.6-r0
alpine 3.18zlib1.2.12-r2
alpine 3.18zlib-ng2.0.6-r0
alpine 3.19zlib1.2.12-r2
alpine 3.19zlib-ng2.0.6-r0
alpine 3.20zlib1.2.12-r2
alpine 3.20zlib-ng2.0.6-r0
alpine 3.21zlib1.2.12-r2
alpine 3.21zlib-ng2.0.6-r0
alpine 3.22zlib1.2.12-r2
alpine 3.22zlib-ng2.0.6-r0
alpine 3.23zlib1.2.12-r2
alpine 3.23zlib-ng2.0.6-r0
alpine 3.24zlib1.2.12-r2
alpine 3.24zlib-ng2.0.6-r0
alpine edgezlib1.2.12-r2
alpine edgezlib-ng2.0.6-r0
amazon linux 1minizip1.2.8-7.20.amzn1
amazon linux 1minizip-devel1.2.8-7.20.amzn1
amazon linux 1zlib1.2.8-7.20.amzn1
amazon linux 1zlib-debuginfo1.2.8-7.20.amzn1
amazon linux 1zlib-devel1.2.8-7.20.amzn1
amazon linux 1zlib-static1.2.8-7.20.amzn1
amazon linux 2minizip1.2.7-19.amzn2.0.2
amazon linux 2minizip-devel1.2.7-19.amzn2.0.2
amazon linux 2rsync3.1.2-11.amzn2.0.2
amazon linux 2rsync-debuginfo3.1.2-11.amzn2.0.2
amazon linux 2zlib1.2.7-19.amzn2.0.2
amazon linux 2zlib-debuginfo1.2.7-19.amzn2.0.2
amazon linux 2zlib-devel1.2.7-19.amzn2.0.2
amazon linux 2zlib-static1.2.7-19.amzn2.0.2
amazon linux 2022minizip-compat1.2.11-33.amzn2022.0.3
amazon linux 2022minizip-compat-debuginfo1.2.11-33.amzn2022.0.3
amazon linux 2022minizip-compat-devel1.2.11-33.amzn2022.0.3
amazon linux 2022rsync3.2.6-1.amzn2022.0.2
amazon linux 2022rsync-daemon3.2.6-1.amzn2022.0.2
amazon linux 2022rsync-debuginfo3.2.6-1.amzn2022.0.2
amazon linux 2022rsync-debugsource3.2.6-1.amzn2022.0.2
amazon linux 2022zlib1.2.11-33.amzn2022.0.3
amazon linux 2022zlib-debuginfo1.2.11-33.amzn2022.0.3
amazon linux 2022zlib-debugsource1.2.11-33.amzn2022.0.3
amazon linux 2022zlib-devel1.2.11-33.amzn2022.0.3
amazon linux 2022zlib-static1.2.11-33.amzn2022.0.3
amazon linux 2023minizip-compat1.2.11-33.amzn2023.0.4
amazon linux 2023minizip-compat-debuginfo1.2.11-33.amzn2023.0.4
amazon linux 2023minizip-compat-devel1.2.11-33.amzn2023.0.4
amazon linux 2023rsync3.2.6-1.amzn2023.0.3
amazon linux 2023rsync-daemon3.2.6-1.amzn2023.0.3
amazon linux 2023rsync-debuginfo3.2.6-1.amzn2023.0.3
amazon linux 2023rsync-debugsource3.2.6-1.amzn2023.0.3
amazon linux 2023zlib1.2.11-33.amzn2023.0.4
amazon linux 2023zlib-debuginfo1.2.11-33.amzn2023.0.4
amazon linux 2023zlib-debugsource1.2.11-33.amzn2023.0.4
amazon linux 2023zlib-devel1.2.11-33.amzn2023.0.4
amazon linux 2023zlib-static1.2.11-33.amzn2023.0.4
bottlerocketlibz1.11.0-b530f308
chainguardzlib1.2.13-r1
conan::GitLab Advisory Database Communityzlib1.2.13
debian 10libz-mingw-w64no fix listed
debian 10zlib1:1.2.11.dfsg-1+deb10u2
debian 11libz-mingw-w64no fix listed
debian 11zlib1:1.2.11.dfsg-2+deb11u2
debian 12libz-mingw-w641.2.12+dfsg-2
debian 12zlib1:1.2.11.dfsg-4.1
debian 13libz-mingw-w641.2.12+dfsg-2
debian 13zlib1:1.2.11.dfsg-4.1
debian 14libz-mingw-w641.2.12+dfsg-2
debian 14zlib1:1.2.11.dfsg-4.1
echoboost-1.69.01.69.0+e1
echoboost-1.75.01.75.0+e1
echoboost-1.84.01.84.0+e1
echolibz-mingw-w641.2.12+dfsg-2
echozlib1:1.2.11.dfsg-4.1
echozlib-1.1.41.1.4+e1
echozlib-1.2.111.2.11+e1
Oracle Linux 6minizip1.2.3-29.0.3.el6
Oracle Linux 6minizip-devel1.2.3-29.0.3.el6
Oracle Linux 6zlib1.2.3-29.0.3.el6
Oracle Linux 6zlib-devel1.2.3-29.0.3.el6
Oracle Linux 6zlib-static1.2.3-29.0.3.el6
Oracle Linux 7minizip1.2.7-21.el7_9
Oracle Linux 7minizip-devel1.2.7-21.el7_9
Oracle Linux 7zlib1.2.7-21.el7_9
Oracle Linux 7zlib-devel1.2.7-21.el7_9
Oracle Linux 7zlib-static1.2.7-21.el7_9
Oracle Linux 8rsync3.1.3-19.el8
Oracle Linux 8rsync-daemon3.1.3-19.el8
Oracle Linux 8zlib1.2.11-19.el8_6
Oracle Linux 8zlib-devel1.2.11-19.el8_6
Oracle Linux 8zlib-static1.2.11-19.el8_6
Oracle Linux 9rsync3.2.3-18.el9
Oracle Linux 9rsync-daemon3.2.3-18.el9
Oracle Linux 9zlib1.2.11-32.el9_0
Oracle Linux 9zlib-devel1.2.11-32.el9_0
Oracle Linux 9zlib-static1.2.11-32.el9_0
rapidfort Oracle Linux 9rsync0:3.2.3-18.el9
rapidfort Oracle Linux 9rsync-daemon0:3.2.3-18.el9
rapidfort Oracle Linux 9zlib0:1.2.11-32.el9_0
rapidfort Oracle Linux 9zlib-devel0:1.2.11-32.el9_0
Red Hatminizipno fix listed
Red Hatminizip-develno fix listed
Red Hatzlibno fix listed
Red Hatzlib-develno fix listed
Red Hatzlib-staticno fix listed
rocky 8rsync3.1.3-19.el8
rocky 8rsync-daemon3.1.3-19.el8
rocky 8zlib1.2.11-19.el8_6
rocky 8zlib-devel1.2.11-19.el8_6
rocky 9rsync3.2.3-18.el9
rocky 9rsync-daemon3.2.3-18.el9
rocky 9zlib1.2.11-32.el9_0
rocky 9zlib-devel1.2.11-32.el9_0
root.io debian 11rootio-zlib1:1.2.11.dfsg-2+deb11u2
root.io debian 12rootio-zlib1:1.2.11.dfsg-4.1
root.io debian 13rootio-zlib1:1.2.11.dfsg-4.1
seal debianseal-zlib1:1.2.11.dfsg-2+deb11u2+sp999
seal debianzlib1:1.2.11.dfsg-2+deb11u2+sp999
seal Red Hat 6rsync3.0.6-12.el6+sp999
seal Red Hat 6seal-rsync3.0.6-12.el6+sp999
seal Red Hat 7rsync3.1.2-12.el7_9+sp999
seal Red Hat 7seal-rsync3.1.2-12.el7_9+sp999
seal Red Hat 7seal-zlib1.2.7-18.el7+sp999, 1.2.7-21.el7_9+sp999
seal Red Hat 7zlib1.2.7-18.el7+sp999, 1.2.7-21.el7_9+sp999
seal Red Hat 8seal-zlib1.2.11-17.el8+sp999, 1.2.11-25.el8+sp999
seal Red Hat 8zlib1.2.11-17.el8+sp999, 1.2.11-25.el8+sp999
ubuntu 14.04-ESMklibc2.0.3-0ubuntu1.14.04.3+esm3
ubuntu 14.04-ESMzlib1:1.2.8.dfsg-1ubuntu1.1+esm2
ubuntu 16.04-ESMklibc2.0.4-8ubuntu1.16.04.4+esm2
ubuntu 16.04-ESMrsync3.1.1-3ubuntu1.3+esm2
ubuntu 16.04-ESMzlib1:1.2.8.dfsg-2ubuntu4.3+esm2
ubuntu 18.04rsync3.1.2-2.1ubuntu1.5
ubuntu 18.04zlib1:1.2.11.dfsg-0ubuntu2.2
ubuntu 18.04-ESMklibc2.0.4-9ubuntu2.2+esm1
ubuntu 18.04-ESMrsync3.1.2-2.1ubuntu1.5
ubuntu 18.04-ESMzlib1:1.2.11.dfsg-0ubuntu2.2
ubuntu 20.04klibc2.0.7-1ubuntu5.2
ubuntu 20.04rsync3.1.3-8ubuntu0.4
ubuntu 20.04zlib1:1.2.11.dfsg-2ubuntu1.5
ubuntu 20.04-ESMklibc2.0.7-1ubuntu5.2
ubuntu 20.04-ESMrsync3.1.3-8ubuntu0.4
ubuntu 20.04-ESMzlib1:1.2.11.dfsg-2ubuntu1.5
ubuntu 22.04klibc2.0.10-4ubuntu0.1
ubuntu 22.04zlib1:1.2.11.dfsg-2ubuntu9.2
ubuntu 23.10klibc2.0.13-1ubuntu0.1
ubuntu 24.04klibc2.0.13-4ubuntu0.1
wolfizlib1.2.13-r1

References

All 54 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.