{"id":"EUVD-2026-64850","enisaUuid":"76ace992-0962-36bd-86c1-813ae691bc59","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","datePublished":"Aug 24, 2026, 1:12:01 PM","dateUpdated":"Oct 1, 2026, 11:03:59 AM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490\nhttps://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148\nhttps://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393\nhttps://github.com/madler/zlib\nhttps://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate\n","aliases":"CVE-2026-76844\nGHSA-p3f5-w63m-mxph\nGHSA-g84c-rxfj-3j2c\n","assigner":"VulnCheck","epss":0.59,"enisaIdProduct":[{"id":"b756fa3e-97b1-3fd9-a88e-04cb0f8974be","product":{"name":"zlib","vendor":{"name":"Ruby"}},"product_version":"1.2.11 ≤1.3.2"}],"enisaIdVendor":[{"id":"d0102f9f-b151-3430-82aa-51c9a617c56f","vendor":{"name":"zlib"}}],"enisaIdVulnerability":[{"id":"0a4695b0-584d-306d-8546-d16fd9bf5a92","vulnerability":{"id":"CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller\u0027s buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","datePublished":"Aug 24, 2026, 1:12:01 PM","dateUpdated":"Oct 1, 2026, 11:03:59 AM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490\nhttps://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148\nhttps://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393\nhttps://github.com/madler/zlib\nhttps://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate\n","enisa_id":"EUVD-2026-64850\n","assigner":"VulnCheck","epss":0.59,"dataProcessed":"Oct 30, 2026, 7:14:57 AM","vulnerabilityProduct":[{"id":"36b2c063-8506-3ce8-9d61-82c9223c83d0","product":{"name":"zlib","vendor":{"name":"Ruby"}},"product_version":"1.2.11 ≤1.3.2"}],"vulnerabilityVendor":[{"id":"e6e2e774-570f-3d12-b75f-2bd295e156d0","vendor":{"name":"zlib"}}]}},{"id":"c2ebad8c-746a-3b16-927d-4826af55879e","vulnerability":{"id":"GHSA-p3f5-w63m-mxph","description":"Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","datePublished":"Aug 24, 2026, 3:31:51 PM","dateUpdated":"Sep 29, 2026, 4:59:08 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844\nhttps://github.com/advisories/GHSA-wr3j-pwj9-hqq6\nhttps://github.com/webpack/webpack-dev-middleware\nhttps://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js\nhttps://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath\n","enisa_id":"EUVD-2026-64850\n","aliases":"GHSA-p3f5-w63m-mxph\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f2eedeab-f49b-3be0-8963-6109d29dcc5b","vulnerability":{"id":"GHSA-g84c-rxfj-3j2c","description":"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath","datePublished":"Sep 29, 2026, 4:59:18 PM","dateUpdated":"Sep 29, 2026, 4:59:18 PM","baseScore":0.0,"references":"https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76844\nhttps://github.com/webpack/webpack-dev-middleware/pull/2404\nhttps://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b\nhttps://github.com/webpack/webpack-dev-middleware/commit/cefccbac330c29052fc6dffe85fd292ea2ac782b\nhttps://github.com/advisories/GHSA-wr3j-pwj9-hqq6\nhttps://github.com/webpack/webpack-dev-middleware\nhttps://github.com/webpack/webpack-dev-middleware/blob/v8.1.1/src/middleware.js\nhttps://github.com/webpack/webpack-dev-middleware/releases/tag/v7.4.6\nhttps://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0\nhttps://www.vulncheck.com/advisories/webpack-dev-middleware-path-traversal-via-offset-slice-on-a-non-slash-terminated-publicpath\n","enisa_id":"EUVD-2026-64850\n","aliases":"CVE-2026-76844\nGHSA-g84c-rxfj-3j2c\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"14e8d925-4871-3b1a-8eba-f65de942e90d","advisory":{"id":"msrc_CVE-2026-76844","description":"zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write","datePublished":"Oct 2, 2026, 1:02:06 AM","dateUpdated":"Oct 17, 2026, 1:43:23 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-76844.json\n","aliases":"CVE-2026-76844\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"5dd92bde-8802-3533-82fd-7aabe13b1c99","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"896e0f51-2d90-32cf-82a4-528b8776c796","product":{"name":"zlib","vendor":{"name":"Ruby"}}},{"id":"8dbdfccd-6106-3a62-af30-39d10c98064b","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"ca67714c-a51a-3d5a-bc2e-f1ef6f12f179","product":{"name":"azl3 zlib 0:1.3.2-1.azl3","vendor":{"name":"Microsoft"}}}]}},{"id":"6af80d8a-0086-3559-bc65-b29e060c9b55","advisory":{"id":"RHSA-2026:61783","description":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","summary":"A Subscription Management tool for finding and reporting Red Hat product usage","datePublished":"Aug 31, 2026, 9:39:55 PM","dateUpdated":"Oct 23, 2026, 9:28:23 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:61783\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61783.json\n","aliases":"CVE-2024-29180\nCVE-2026-1965\nCVE-2026-3783\nCVE-2026-5704\nCVE-2026-6322\nCVE-2026-6653\nCVE-2026-8286\nCVE-2026-9547\nCVE-2026-11822\nCVE-2026-11824\nCVE-2026-11979\nCVE-2026-14164\nCVE-2026-15588\nCVE-2026-18477\nCVE-2026-18508\nCVE-2026-41991\nCVE-2026-41992\nCVE-2026-45409\nCVE-2026-45623\nCVE-2026-54284\nCVE-2026-54371\nCVE-2026-56434\nCVE-2026-58010\nCVE-2026-58011\nCVE-2026-58012\nCVE-2026-58013\nCVE-2026-58014\nCVE-2026-58015\nCVE-2026-58055\nCVE-2026-59868\nCVE-2026-59869\nCVE-2026-59893\nCVE-2026-60005\nCVE-2026-67213\nCVE-2026-67214\nCVE-2026-71491\nCVE-2026-73643\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-76844\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0ad82c29-c689-314c-9c0a-796baf4f6a3c","product":{"name":"Red Hat Discovery 2","vendor":{"name":"Red Hat"}}},{"id":"38a03c4b-3e68-36e6-85e1-27856f5b2d62","product":{"name":"registry.redhat.io/discovery/discovery-server-rhel9@sha256:5efae8059c9c15454abac947b8482412686d60aaf5c104557d463e8282e340af_amd64","vendor":{"name":"Red Hat"}}},{"id":"459d3f2b-0029-31d9-a24f-ba92770522ce","product":{"name":"registry.redhat.io/discovery/discovery-ui-rhel9@sha256:480c69f89b45c714ec13a7901bc8615a2fa3f4622c889cd023d80a6278855a58_arm64","vendor":{"name":"Red Hat"}}},{"id":"4a1d9b80-0cb1-3457-baff-61fd70114db3","product":{"name":"registry.redhat.io/discovery/discovery-server-rhel9@sha256:e9592a7aa5db3a61a7248d7b0305f3eb2fae189b1d078e483f1cc439f5b2351d_arm64","vendor":{"name":"Red Hat"}}},{"id":"d5ed6d86-d910-3235-bf12-b92ec1a652ca","product":{"name":"registry.redhat.io/discovery/discovery-ui-rhel9@sha256:def96951197558d6c5d1784a7971b0e37b44025c60d9b59fe6797085e39c382a_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"c334d0be-cd1d-347b-9fea-e2dce5e8d6ea","advisory":{"id":"RHSA-2026:68681","description":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update","summary":"The Migration Toolkit for Containers (MTC) 1.8.17 is now available.","datePublished":"Sep 17, 2026, 2:19:21 PM","dateUpdated":"Oct 24, 2026, 10:38:46 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:68681\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68681.json\n","aliases":"CVE-2026-14257\nCVE-2026-16221\nCVE-2026-27145\nCVE-2026-33186\nCVE-2026-33818\nCVE-2026-42504\nCVE-2026-56852\nCVE-2026-56853\nCVE-2026-56859\nCVE-2026-56860\nCVE-2026-56862\nCVE-2026-59869\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-67313\nCVE-2026-67314\nCVE-2026-67320\nCVE-2026-67321\nCVE-2026-69152\nCVE-2026-69192\nCVE-2026-73088\nCVE-2026-73089\nCVE-2026-73566\nCVE-2026-73643\nCVE-2026-73646\nCVE-2026-75899\nCVE-2026-75931\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-76844\nCVE-2026-82417\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-84394\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"03aa8e7c-2f7b-37f7-943c-45814c7873ea","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:8e4d03a2c6e77c84439e8def9c36953576011cd224cfd50cfff9242180e6c4d7_amd64","vendor":{"name":"Red Hat"}}},{"id":"50dc85fb-a4a7-35cb-839c-5bef0d2581dd","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:467ef1c1acaa26dffd410f265900b6db4d0f88caf3f72df376a355c0820e4298_amd64","vendor":{"name":"Red Hat"}}},{"id":"52cdf8ae-51cb-3bf4-a99d-f5fae4f20173","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:87f134b3db20370a415bb96123c0690d598a93610f89b45823b830d281f36c6c_amd64","vendor":{"name":"Red Hat"}}},{"id":"5ef03ae2-a44c-3692-95ca-99341c978c7a","product":{"name":"Red Hat Migration Toolkit 1.8","vendor":{"name":"Red Hat"}}},{"id":"6516dd33-38d2-3389-9ee0-2dec10cf2ec2","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:9961d5c585af5831ab25f440ca32f958485a3eb84d6cce7173a7167432778f84_amd64","vendor":{"name":"Red Hat"}}},{"id":"71fe89ca-3fe3-3336-a80f-f943df4d1950","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:8bcf84ef7c8c79bd2224b861a051917b2cce9549863fea896cbe03a513177171_amd64","vendor":{"name":"Red Hat"}}},{"id":"968da563-5536-38f1-9247-b1dcc93d70b7","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:1ef05217f688e882b2354cae164a2ae7f1e24ae793dc1f0351f333e5054383f6_amd64","vendor":{"name":"Red Hat"}}},{"id":"9be6d578-44d2-3098-90c7-17dc57903d9b","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:cc6bb647f74d614d696b8d7be5f25de0a9aebe013457495e2806b732bcbfa241_amd64","vendor":{"name":"Red Hat"}}},{"id":"aa7261e8-9386-306d-8945-21e0bbaf0217","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:42b6863e399bd9f95aedaedd769b5d607db2412fcaea016119bc0ff881ee125a_amd64","vendor":{"name":"Red Hat"}}},{"id":"d20c2086-f0e2-329a-a270-01e12a4890a0","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:b0162a8598f4f1acf18c94bd27aca8104f1b3a4e036b8f698be05e4cbab62575_amd64","vendor":{"name":"Red Hat"}}},{"id":"f9da4459-9bff-37c2-8e1d-58bfac0558a2","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:b09dab61882a823bc8e5096ea1d62ddbfd1837bb6df5bf756b332935c4943bbb_amd64","vendor":{"name":"Red Hat"}}},{"id":"fcf901bb-3cea-317f-b6b4-29079fe87705","product":{"name":"registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:ce435846f362de451154a574817756b44f5e1fa5d31094987a4be8935f81eb14_amd64","vendor":{"name":"Red Hat"}}}]}},{"id":"db4b7680-9214-3f12-88c9-f21f492d765a","advisory":{"id":"RHSA-2026:69296","description":"Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update","summary":"An update for Red Hat Data Grid 8 is now available.\n \nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Sep 21, 2026, 12:19:52 PM","dateUpdated":"Oct 22, 2026, 8:39:30 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:69296\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69296.json\n","aliases":"CVE-2026-44891\nCVE-2026-49978\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-55851\nCVE-2026-56745\nCVE-2026-56746\nCVE-2026-56817\nCVE-2026-56819\nCVE-2026-56820\nCVE-2026-59296\nCVE-2026-59899\nCVE-2026-59901\nCVE-2026-62243\nCVE-2026-68494\nCVE-2026-73508\nCVE-2026-76844\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"f102e50b-621e-343f-ba74-78e1add3419a","product":{"name":"Red Hat Data Grid 8.6.3","vendor":{"name":"Red Hat"}}}]}}]}