CVE Feed

Dashboard / CVE / CVE-2022-37434

CVE-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Published:Aug 5, 2022

Last Modified:Jul 14, 2026

EPS:Aug 5, 2022

EPSS Score:0.16004

CVSS Score:9.8

Affected Products

Vendor

Product

Action

Vendor

Apple

Product

Ipados

Apple

Ipados

Vendor

Apple

Product

Iphone Os

Apple

Iphone Os

Vendor

Apple

Product

Macos

Apple

Macos

Vendor

Apple

Product

Watchos

Apple

Watchos

Vendor

Debian

Product

Debian Linux

Debian

Debian Linux

Vendor

Fedoraproject

Product

Fedora

Fedoraproject

Fedora

Vendor

Netapp

Product

Active Iq Unified Manager

Netapp

Active Iq Unified Manager

Vendor

Netapp

Product

H300s

Netapp

H300s

Vendor

Netapp

Product

H300s Firmware

Netapp

H300s Firmware

Vendor

Netapp

Product

H500s

Netapp

H500s

Vendor

Netapp

Product

H500s Firmware

Netapp

H500s Firmware

Vendor

Netapp

Product

H700s

Netapp

H700s

Vendor

Netapp

Product

H700s Firmware

Netapp

H700s Firmware

Vendor

Netapp

Product

Hci

Netapp

Hci

Vendor

Netapp

Product

Hci Compute Node

Netapp

Hci Compute Node

Vendor

Netapp

Product

Management Services For Element Software

Netapp

Management Services For Element Software

Vendor

Netapp

Product

Oncommand Workflow Automation

Netapp

Oncommand Workflow Automation

Vendor

Netapp

Product

Ontap Select Deploy Administration Utility

Netapp

Ontap Select Deploy Administration Utility

Vendor

Netapp

Product

Storagegrid

Netapp

Storagegrid

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Core Services

Redhat

Jboss Core Services

Vendor

Redhat

Product

Rhel Eus

Redhat

Rhel Eus

Vendor

Stormshield

Product

Stormshield Network Security

Stormshield

Stormshield Network Security

Vendor

Zlib

Product

Zlib

Zlib

Zlib

Exploits

https://github.com/curl/curl/issues/9271 https://github.com/ivd38/zlib_overflow https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063 https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764 https://github.com/curl/curl/issues/9271 https://github.com/ivd38/zlib_overflow https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063 https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764 https://github.com/curl/curl/issues/9271 https://github.com/Trinadh465/external_zlib_android-6.0.1_r22_CVE-2022-37434 https://github.com/Trinadh465/external_zlib_CVE-2022-37434 https://github.com/xen0bit/CVE-2022-37434_poc

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-787 Out-of-bounds Write

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-67 String Format Overflow in syslog()

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

CAPEC-92 Forced Integer Overflow

Related CVEs

CVE-2026-65367 (CVSS 5.5) — A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and…

CVE-2026-43670 (CVSS 8.8) — A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue …

CVE-2026-65331 (CVSS 4.3) — This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 …

CVE-2026-64760 (CVSS 5.5) — An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS…

CVE-2026-43794 (CVSS 8.8) — A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, i…

CVE-2026-65346 (CVSS 8.8) — An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS…

CVE-2026-65351 (CVSS 4.3) — This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 a…

CVE-2026-64782 (CVSS 3.1) — A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, i…

CVE-2026-65347 (CVSS 6.5) — The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe…

CVE-2026-43795 (CVSS 4.3) — The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and i…

References

http://seclists.org/fulldisclosure/2022/Oct/37

http://seclists.org/fulldisclosure/2022/Oct/38

http://seclists.org/fulldisclosure/2022/Oct/41

http://seclists.org/fulldisclosure/2022/Oct/42

http://www.openwall.com/lists/oss-security/2022/08/05/2

http://www.openwall.com/lists/oss-security/2022/08/09/1

https://github.com/curl/curl/issues/9271

https://github.com/ivd38/zlib_overflow

https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063

https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d

https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1

https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764

https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/

https://security.netapp.com/advisory/ntap-20220901-0005/

https://security.netapp.com/advisory/ntap-20230427-0007/

https://support.apple.com/kb/HT213488

https://support.apple.com/kb/HT213489

https://support.apple.com/kb/HT213490

https://support.apple.com/kb/HT213491

https://support.apple.com/kb/HT213493

https://support.apple.com/kb/HT213494

https://www.debian.org/security/2022/dsa-5218

http://seclists.org/fulldisclosure/2022/Oct/37

http://seclists.org/fulldisclosure/2022/Oct/38

http://seclists.org/fulldisclosure/2022/Oct/41

http://seclists.org/fulldisclosure/2022/Oct/42

http://www.openwall.com/lists/oss-security/2022/08/05/2

http://www.openwall.com/lists/oss-security/2022/08/09/1

https://github.com/curl/curl/issues/9271

https://github.com/ivd38/zlib_overflow

https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063

https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1

https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764

https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/

https://security.netapp.com/advisory/ntap-20220901-0005/

https://security.netapp.com/advisory/ntap-20230427-0007/

https://support.apple.com/kb/HT213488

https://support.apple.com/kb/HT213489

https://support.apple.com/kb/HT213490

https://support.apple.com/kb/HT213491

https://support.apple.com/kb/HT213493

https://support.apple.com/kb/HT213494

https://www.debian.org/security/2022/dsa-5218

https://cert-portal.siemens.com/productcert/html/ssa-150063.html

https://cert-portal.siemens.com/productcert/html/ssa-202008.html

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

https://cert-portal.siemens.com/productcert/html/ssa-470355.html

https://cert-portal.siemens.com/productcert/html/ssa-561322.html

https://github.com/curl/curl/issues/9271

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High