MiracleLinux 9 : ruby:3.3 (AXSA:2026-1647:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1647:01 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Astra Linux – Vulnerability in Ruby 2.5

Zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0, and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends bytes provided by the caller before previously produced...

ROOT-OS-DEBIAN-11-CVE-2023-45853 CVE-2023-45853 in zlib - Patched by Root

Root has patched CVE-2023-45853 in the zlib package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-27171 CVE-2026-27171 in zlib - Patched by Root

Root has patched CVE-2026-27171 in the zlib package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-77640

A flaw was found in tor. A remote attacker could send a specially crafted, truncated zlib/gzip stream. This could lead to an infinite loop during decompression, causing a denial of service DoS in the affected component. Mitigation Mitigation for this issue is either not available or the currently...

Linux Distros Unpatched Vulnerability : CVE-2026-77640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...

DEBIAN-CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

DEBIAN-CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-63650

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

Tor before 0.4.9.9 is vulnerable to a denial of service when decompressing a truncated zlib/gzip stream with done=1. The root cause is in buf_add_compress() : a truncated stream never reaches Z_STREAM_END, so zlib returns Z_BUF_ERROR with no input remaining, which the function misinterpreted as a...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-63648

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...