CVE-2022-37434
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
Published Aug 5, 2022 · updated Oct 14, 2026 · zlib zlib
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Timeline
Detection, updates, and resolution for this record.
Aug 5, 2022 · NIST NVD
Detected
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Oct 14, 2026 · NIST NVD
Updated
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Affected
- cpe debian/debian linux10.0
- cpe fedoraproject/fedora35
- cpe fedoraproject/fedora36
- cpe fedoraproject/fedora37
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe netapp/h700s firmwareversion unspecified
- cpe netapp/hciversion unspecified
- cpe zlib/zlibversion unspecified
Sources
- CVE.orgCVE-2022-37434
Official CVE identifier
cve.org - NIST NVDCVE-2022-37434
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable t
nvd.nist.gov