CVE-2022-37434
criticalzlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
Vendor / product: Zlib — zlib
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2022-08-05 07:15
Modified: 2026-10-14 18:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
zlib / zlib ≤1.2.12
fedoraproject / fedora 35, 36, 37
debian / debian_linux 10.0
netapp / active_iq_unified_manager all versions
netapp / hci all versions
netapp / management_services_for_element_software all versions
netapp / oncommand_workflow_automation all versions
netapp / ontap_select_deploy_administration_utility all versions
netapp / storagegrid all versions
netapp / hci_compute_node all versions
netapp / h300s_firmware all versions
netapp / h500s_firmware all versions
netapp / h700s_firmware all versions
apple / ipados <15.7.1
apple / iphone_os <15.7.1, ≥16.0 <16.1
apple / macos ≥11.0 <11.7.1, ≥12.0.0 <12.6.1
apple / watchos <9.1
stormshield / stormshield_network_security ≥3.7.31 <3.7.34, ≥3.11.0 <3.11.22, ≥4.3.0 <4.3.16, ≥4.6.0 <4.6.3
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: http://www.openwall.com/lists/oss-security/2022/08/09/1
Patch / mitigation: https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
Patch / mitigation: http://www.openwall.com/lists/oss-security/2022/08/09/1
Patch / mitigation: https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
References
- http://seclists.org/fulldisclosure/2022/Oct/37 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Oct/38 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Oct/41 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Oct/42 cve@mitre.org
- http://www.openwall.com/lists/oss-security/2022/08/05/2 cve@mitre.org
- http://www.openwall.com/lists/oss-security/2022/08/09/1 cve@mitre.org
- https://github.com/curl/curl/issues/9271 cve@mitre.org
- https://github.com/ivd38/zlib_overflow cve@mitre.org
- https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-... cve@mitre.org
- https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d cve@mitre.org
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 cve@mitre.org
- https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inf... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://security.netapp.com/advisory/ntap-20220901-0005/ cve@mitre.org
- https://security.netapp.com/advisory/ntap-20230427-0007/ cve@mitre.org
- https://support.apple.com/kb/HT213488 cve@mitre.org
- https://support.apple.com/kb/HT213489 cve@mitre.org
- https://support.apple.com/kb/HT213490 cve@mitre.org
- https://support.apple.com/kb/HT213491 cve@mitre.org
- https://support.apple.com/kb/HT213493 cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗