CVE-2022-37434 zlib
| Affected software | zlib |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Weakness | Out-of-bounds write (CWE-787) |
| Published | 5 Aug 2022 |
| Updated | 14 Oct 2026 |
Description
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
CWE-120
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: partial.
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 19% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | u think that it doesnt but it do | 3 | 2022-10-15 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Supply Chain / CAX Client (zlib) (3.6) |
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Siebel CRM / Repository Utilities (zlib) (24.6 and prior) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Hyperion / Security (zlib) (11.2.14.0.000) Oracle JD Edwards / Interactive Engine SEC (zlib) (Prior to 9.2.8.0) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Communications / Virtual Network Function Manager (zlib) (8.6.0.0) Oracle Food and Beverage Applications / Linux POS (MySQL Server) (19.5) Oracle Retail Applications / Operations & Maintenance (zlib) (15.0, 16.0) Oracle Supply Chain / Installation (zlib) (6.2.1.0-6.2.1.8) Oracle Supply Chain / Security (zlib) (21.0.2.0-21.0.2.7) Oracle's note: This vulnerability applies to Oracle AutoVue Office, Oracle AutoVue 2D Professional, Oracle AutoVue 3D Professional Advanced, Oracle AutoVue EDA Professional and Oracle AutoVue Electro-Mechanical Professional. Please refer to Patch Availability Document for more details. |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Analytics / Analytics Server (zlib) (6.4.0.0.0) Oracle Communications / Core (zlib) (12.6.0.0.0) Oracle Communications / Mediation Engine (glibc) (5.0) Oracle Communications / Routing (zlib) (3.3, 4.0) Oracle Communications / Routing (zlib) (8.45, 9.15) Oracle Communications / Routing (zlib) (9.0, 9.1) Oracle Communications / Routing (zlib) (9.0, 9.1) Oracle Communications / Routing (zlib) (9.0, 9.1) Oracle Communications / Routing (zlib) (9.1) Oracle Fusion Middleware / SSL Module (zlib) (12.2.1.4.0) Oracle MySQL / InnoDB (zlib) (5.7.41 and prior, 8.0.31 and prior) Oracle Retail Applications / RPAS Server (zlib) (15.0.3, 16.0.3) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Communications / Configuration (zlib) (22.3.1) Oracle Communications / Install/Upgrade (zlib) (22.1.1) Oracle Communications / Platform (zlib) (8.6.0.0) Oracle Fusion Middleware / DC-Specific Component (zlib) (8.5.6) Oracle MySQL / Workbench (zlib) (8.0.31 and prior) Oracle PeopleSoft / PeopleSoft CDA (zlib) (8.58, 8.59, 8.60) Oracle TimesTen In-Memory Database / In-Memory Database (zlib) (Prior to 11.2.2.8.65) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Analytics Server (zlib) | 6.4.0.0.0 | 6.4.0.0.0 |
| Oracle Communications | Configuration (zlib) | 22.3.1 | 22.3.1 |
| Oracle Communications | Core (zlib) | 12.6.0.0.0 | 12.6.0.0.0 |
| Oracle Communications | Install/Upgrade (zlib) | 22.1.1 | 22.1.1 |
| Oracle Communications | Mediation Engine (glibc) | 5.0 | 5.0 |
| Oracle Communications | Platform (zlib) | 8.6.0.0 | 8.6.0.0 |
| Oracle Communications | Routing (zlib) | 3.3, 4.0 | 3.3 · 4.0 · 8.45 · 9.0 · 9.1 · 9.15 |
| Oracle Communications | Virtual Network Function Manager (zlib) | 8.6.0.0 | 8.6.0.0 |
| Oracle Food and Beverage Applications | Linux POS (MySQL Server) | 19.5 | 19.5 |
| Oracle Fusion Middleware | DC-Specific Component (zlib) | 8.5.6 | 8.5.6 |
| Oracle Fusion Middleware | SSL Module (zlib) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Hyperion | Security (zlib) | 11.2.14.0.000 | 11.2.14.0.0 |
| Oracle JD Edwards | Interactive Engine SEC (zlib) | Prior to 9.2.8.0 | |
| Oracle MySQL | InnoDB (zlib) | 5.7.41 and prior, 8.0.31 and prior | |
| Oracle MySQL | Workbench (zlib) | 8.0.31 and prior | |
| Oracle PeopleSoft | PeopleSoft CDA (zlib) | 8.58, 8.59, 8.60 | 8.58 · 8.59 · 8.60 |
| Oracle Retail Applications | Operations & Maintenance (zlib) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | RPAS Server (zlib) | 15.0.3, 16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Siebel CRM | Repository Utilities (zlib) | 24.6 and prior | |
| Oracle Supply Chain | CAX Client (zlib) | 3.6 | 3.6 |
| Oracle Supply Chain | Installation (zlib) | 6.2.1.0-6.2.1.8 | |
| Oracle Supply Chain | Security (zlib) | 21.0.2.0-21.0.2.7 | |
| Oracle TimesTen In-Memory Database | In-Memory Database (zlib) | Prior to 11.2.2.8.65 |
Products and versions
18 products, 25 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apple | ipados | generic | ＜ 15.7.1 |
| nvd | apple | iphone os | generic | ＜ 15.7.1 · ≥ 16.0 and ＜ 16.1 |
| nvd | apple | macos | generic | ≥ 11.0 and ＜ 11.7.1 · ≥ 12.0.0 and ＜ 12.6.1 |
| nvd | apple | watchos | generic | ＜ 9.1 |
| nvd | debian | debian linux | generic | 10.0 |
| nvd | fedoraproject | fedora | generic | 35 · 36 · 37 |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | h300s firmware | generic | any version |
| nvd | netapp | h500s firmware | generic | any version |
| nvd | netapp | h700s firmware | generic | any version |
| nvd | netapp | hci | generic | any version |
| nvd | netapp | hci compute node | generic | any version |
| nvd | netapp | management services for element software | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | ontap select deploy administration utility | generic | any version |
| nvd | netapp | storagegrid | generic | any version |
| nvd | stormshield | stormshield network security | generic | ≥ 3.7.31 and ＜ 3.7.34 · ≥ 3.11.0 and ＜ 3.11.22 · ≥ 4.3.0 and ＜ 4.3.16 · ≥ 4.6.0 and ＜ 4.6.3 |
| nvd | zlib | zlib | generic | ≤ 1.2.12 |
References
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2022/Oct/37 | Mailing List, Third Party Advisory |
| http://seclists.org/fulldisclosure/2022/Oct/38 | Mailing List, Third Party Advisory |
| http://seclists.org/fulldisclosure/2022/Oct/41 | Mailing List, Third Party Advisory |
| http://seclists.org/fulldisclosure/2022/Oct/42 | Mailing List, Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2022/08/05/2 | Mailing List, Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2022/08/09/1 | Mailing List, Patch, Third Party Advisory |
| https://github.com/curl/curl/issues/9271 | Exploit, Issue Tracking, Third Party Advisory |
| https://github.com/ivd38/zlib_overflow | Exploit, Third Party Advisory |
| https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063 | Exploit, Third Party Advisory |
| https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d |
Timeline
Timeline
| Published | 2022-08-05 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-14 | NVD's own last-modified date for this record. |