CVE-2022-37434
- Source
- https://cve.org/CVERecord?id=CVE-2022-37434
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37434.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-37434
- Downstream
- Related
- Published
- 2022-08-05T07:15:07.240Z
- Modified
- 2026-04-16T04:30:31.537908689Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/
- http://seclists.org/fulldisclosure/2022/Oct/42
- https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/
- https://security.netapp.com/advisory/ntap-20230427-0007/
- http://seclists.org/fulldisclosure/2022/Oct/37
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://www.openwall.com/lists/oss-security/2022/08/05/2
- https://security.netapp.com/advisory/ntap-20220901-0005/
- https://support.apple.com/kb/HT213489
- https://support.apple.com/kb/HT213493
- https://support.apple.com/kb/HT213494
- https://www.debian.org/security/2022/dsa-5218
- https://support.apple.com/kb/HT213488
- https://support.apple.com/kb/HT213490
- https://support.apple.com/kb/HT213491
- http://seclists.org/fulldisclosure/2022/Oct/38
- https://github.com/curl/curl/issues/9271
- https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
- http://www.openwall.com/lists/oss-security/2022/08/09/1
- https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
- https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764
- https://github.com/ivd38/zlib_overflow
- https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063
Affected packages
Git / github.com/madler/zlib
Affected ranges
- Type
- GIT
- Repo
- https://github.com/madler/zlib
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedFixedFixed
- Database specific
{ "versions": [ { "introduced": "0" }, { "last_affected": "1.2.12" } ] }
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroducedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "versions": [ { "introduced": "0" }, { "last_affected": "10.0" }, { "introduced": "16.0" }, { "fixed": "16.1" }, { "introduced": "0" }, { "fixed": "9.1" } ] }
Affected versions
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v0.71
v0.79
v0.8
v0.9
v0.91
v0.92
v0.93
v0.94
v0.95
v0.99
v1.*
v1.0-pre
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.0.5
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.2.0
v1.2.0.1
v1.2.0.2
v1.2.0.3
v1.2.0.4
v1.2.0.5
v1.2.0.6
v1.2.0.7
v1.2.0.8
v1.2.1
v1.2.1.1
v1.2.1.2
v1.2.10
v1.2.11
v1.2.12
v1.2.2
v1.2.2.1
v1.2.2.2
v1.2.2.3
v1.2.2.4
v1.2.3
v1.2.3.1
v1.2.3.2
v1.2.3.3
v1.2.3.4
v1.2.3.5
v1.2.3.6
v1.2.3.7
v1.2.3.8
v1.2.3.9
v1.2.4
v1.2.4-pre1
v1.2.4-pre2
v1.2.4.1
v1.2.4.2
v1.2.4.3
v1.2.4.4
v1.2.4.5
v1.2.5
v1.2.5.1
v1.2.5.2
v1.2.5.3
v1.2.6
v1.2.6.1
v1.2.7
v1.2.7.1
v1.2.7.2
v1.2.7.3
v1.2.8
v1.2.9
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v10.*
v10.0.0
v16.*
v16.0.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v3.*
v3.0.0
v9.*
v9.0.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37434.json"
vanir_signatures
[
{
"source": "https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1",
"target": {
"file": "inflate.c"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2022-37434-9cc3d83a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173736815835493425863590097173702475962",
"129220127786011023031116653503455261516",
"158253382744967794372166426227829451328",
"208646129568712116042670616434092925745",
"267897132422978847766130599021982102399",
"89021460256006972424927287623588351745",
"257784892650917064621950304120855216852"
]
}
}
]
vanir_signatures_modified
"2026-04-11T23:42:04Z"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "36"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "37"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.7.1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.7.1"
}
]
},
{
"events": [
{
"introduced": "11.0"
},
{
"fixed": "11.7.1"
}
]
},
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.6.1"
}
]
},
{
"events": [
{
"introduced": "3.7.31"
},
{
"fixed": "3.7.34"
}
]
},
{
"events": [
{
"introduced": "3.11.0"
},
{
"fixed": "3.11.22"
}
]
},
{
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.16"
}
]
},
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.3"
}
]
}
]