UBUNTU-CVE-2026-22184

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-22184

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-22184

Upstream

CVE-2026-22184

Published

2026-01-07T21:16:00Z

Modified

2026-01-14T21:53:56.855560Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

zlib versions up to and including 1.3.1.2 contain a global buffer overflow in the untgz utility. The TGZfname() function copies an attacker-supplied archive name from argv[] into a fixed-size 1024-byte static global buffer using an unbounded strcpy() call without length validation. Supplying an archive name longer than 1024 bytes results in an out-of-bounds write that can lead to memory corruption, denial of service, and potentially code execution depending on compiler, build flags, architecture, and memory layout. The overflow occurs prior to any archive parsing or validation.

References

Affected packages

Ubuntu:16.04:LTS

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-1ubuntu1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:18.04:LTS

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-3ubuntu1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-2ubuntu1

0.6.2-3ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-3ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:20.04:LTS

rsync

Package

Name: rsync
Purl: pkg:deb/ubuntu/rsync@3.1.3-8ubuntu0.9?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.3-6

3.1.3-8

3.1.3-8ubuntu0.1

3.1.3-8ubuntu0.2

3.1.3-8ubuntu0.3

3.1.3-8ubuntu0.4

3.1.3-8ubuntu0.5

3.1.3-8ubuntu0.7

3.1.3-8ubuntu0.8

3.1.3-8ubuntu0.9

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "rsync",
            "binary_version": "3.1.3-8ubuntu0.9"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-3ubuntu1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-3ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-3ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:22.04:LTS

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-3ubuntu1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-3ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-3ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:24.04:LTS

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-5build1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-5

0.6.2-5build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-5build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:25.04

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-7ubuntu1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-6

0.6.2-7

0.6.2-7ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-7ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:25.10

zsync

Package

Name: zsync
Purl: pkg:deb/ubuntu/zsync@0.6.2-8?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.6.2-7ubuntu1

0.6.2-8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "zsync",
            "binary_version": "0.6.2-8"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:Pro:16.04:LTS

rsync

Package

Name: rsync
Purl: pkg:deb/ubuntu/rsync@3.1.1-3ubuntu1.3+esm4?arch=source&distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.1-3

3.1.1-3ubuntu1

3.1.1-3ubuntu1.1

3.1.1-3ubuntu1.2

3.1.1-3ubuntu1.3

3.1.1-3ubuntu1.3+esm1

3.1.1-3ubuntu1.3+esm2

3.1.1-3ubuntu1.3+esm3

3.1.1-3ubuntu1.3+esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "rsync",
            "binary_version": "3.1.1-3ubuntu1.3+esm4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"

Ubuntu:Pro:18.04:LTS

rsync

Package

Name: rsync
Purl: pkg:deb/ubuntu/rsync@3.1.2-2.1ubuntu1.6+esm2?arch=source&distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.2-2

3.1.2-2.1

3.1.2-2.1ubuntu1

3.1.2-2.1ubuntu1.1

3.1.2-2.1ubuntu1.2

3.1.2-2.1ubuntu1.3

3.1.2-2.1ubuntu1.4

3.1.2-2.1ubuntu1.5

3.1.2-2.1ubuntu1.6

3.1.2-2.1ubuntu1.6+esm1

3.1.2-2.1ubuntu1.6+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "rsync",
            "binary_version": "3.1.2-2.1ubuntu1.6+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-22184.json"