CVE-2026-4176 | SHAY perl up to 5.43.8 Compress Compress::Raw vulnerable third-party component (EUVD-2026-17044)

VDB-354135 · CVE-2026-4176 · EUVD-2026-17044 SHAY PERL UP TO 5.43.8 COMPRESS COMPRESS::RAW VULNERABLE THIRD-PARTY COMPONENT HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.4 $0-$5k 4.59+ Summaryinfo A vulnerability was found in SHAY perl up to 5.43.8. It has been classified as problematic. Affected by this issue is the function Compress::Raw in the library Compress. Performing a manipulation results in vulnerable third-party component. This vulnerability is known as CVE-2026-4176. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended. Detailsinfo A vulnerability, which was classified as problematic, was found in SHAY perl up to 5.43.8. This affects the function Compress::Raw in the library Compress. The manipulation with an unknown input leads to a vulnerable third-party component vulnerability. CWE is classifying the issue as CWE-1395. The product has a dependency on a third-party component that contains one or more known vulnerabilities. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94. This vulnerability is uniquely identified as CVE-2026-4176 since 03/14/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. Upgrading to version 5.40.4-RC1, 5.42.2-RC1 or 5.43.9 eliminates this vulnerability. Applying the patch c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-17044). Productinfo Type Programming Language Software Vendor SHAY Name perl Version 5.43.0 5.43.1 5.43.2 5.43.3 5.43.4 5.43.5 5.43.6 5.43.7 5.43.8 License open-source CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.6 VulDB Meta Temp Score: 5.4 VulDB Base Score: 5.6 VulDB Temp Score: 5.4 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Vulnerable third-party component CWE: CWE-1395 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: perl 5.40.4-RC1/5.42.2-RC1/5.43.9 Patch: c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 Timelineinfo 03/14/2026 CVE reserved 03/30/2026 +15 days Advisory disclosed 03/30/2026 +0 days VulDB entry created 03/30/2026 +0 days VulDB entry last update Sourcesinfo Status: Confirmed CVE: CVE-2026-4176 (🔒) GCVE (CVE): GCVE-0-2026-4176 GCVE (VulDB): GCVE-100-354135 EUVD: 🔒 Entryinfo Created: 03/30/2026 07:30 Updated: 03/30/2026 09:09 Changes: 03/30/2026 07:30 (57), 03/30/2026 09:09 (1) Complete: 🔍 Cache ID: 99:F2E:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸