CVE-2026-4176: 
NixOS vulnerability analysis and mitigation

CVE-2026-4176 is a critical vulnerability in Perl's bundled Compress::Raw::Zlib module caused by the inclusion of an outdated, vulnerable version of the zlib compression library. It affects Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, and from 5.43.0 before 5.43.9. The vulnerability is related to CVE-2026-3381 and includes sub-vulnerabilities such as CVE-2026-27171 in the vendored zlib. It was disclosed on March 29, 2026, by CPANSec, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly). IBM products including Tivoli Network Manager IP Edition and Instana Observability (OnPrem) are also affected due to their use of Perl (IBM Advisory).

The root cause is the use of an unmaintained third-party component (CWE-1104): Perl ships Compress::Raw::Zlib as a dual-life core module with a vendored copy of zlib that was not kept up to date with upstream security fixes. The vulnerable zlib code contains multiple flaws (referenced via CVE-2026-3381 and CVE-2026-27171) that can be triggered through network-accessible compression functionality without authentication or user interaction. The fix involved updating the bundled Compress::Raw::Zlib to version 2.221 (incorporating zlib 1.3.2), as reflected in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94, which addressed issues including integer type mismatches, symbol prefixing, and unsafe CRC table initialization (Perl Commit, GitHub Advisory).

Successful exploitation could allow a remote, unauthenticated attacker to compromise the confidentiality, integrity, and availability of affected systems — including potential arbitrary code execution or denial of service through the vulnerable compression functionality. Because Compress::Raw::Zlib is a core Perl module used widely across Perl applications, the attack surface is broad and affects any Perl-based service that processes compressed data. Downstream products such as IBM Tivoli Network Manager IP Edition and IBM Instana Observability are also at risk, extending the potential impact to enterprise network management and observability infrastructure (Feedly, IBM Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.009% (0.000090), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated, network-exploitable nature and the critical CVSS score warrant prioritized patching, particularly for internet-facing Perl-based services.

The primary remediation is to upgrade Perl to a fixed version: 5.40.4 or later (for the 5.9.4–5.40.x branch), 5.42.2 or later (for the 5.41.x–5.42.x branch), or 5.43.9 or later (for the 5.43.x branch) (GitHub Advisory). As an alternative for any Perl version, installing Compress::Raw::Zlib version 2.221 or 2.222 directly from CPAN resolves the vulnerability without requiring a full Perl upgrade (oss-security). Organizations unable to patch immediately should consider restricting network access to systems using Perl-based compression functionality or disabling compression features where operationally feasible. IBM has issued separate advisories for affected products including Tivoli Network Manager IP Edition and Instana Observability (IBM Advisory, IBM Instana).

The vulnerability was announced by CPANSec via the cve-announce mailing list and cross-posted to oss-security, where community members noted that installing Compress::Raw::Zlib 2.222 from CPAN is a viable workaround for any Perl version (oss-security). The Hacker Wire published a dedicated article highlighting the critical severity of the flaw in Perl's compression module (The Hacker Wire). The Perl community discussed the releases of Perl 5.42.2 and 5.40.4 on Reddit, acknowledging the security fixes included (Reddit). Red Hat opened a Bugzilla tracking entry and is assessing impact across its product portfolio (Red Hat Bugzilla).