CVE-2026-22184

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

• CWE-787
• CWE-787
• CWE-120

• https://github.com/madler/zlibProduct
• https://seclists.org/fulldisclosure/2026/Jan/3Mailing List, Third Party Advisory
• https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfnameThird Party Advisory
• https://zlib.net/Product
• https://github.com/madler/zlib/issues/1142Issue Tracking
• https://access.redhat.com/security/cve/CVE-2026-22184
• https://bugzilla.redhat.com/show_bug.cgi?id=2427688
• https://cert-portal.siemens.com/productcert/html/ssa-470355.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json

Published

Jan 7, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22179OpenClaw versions prior to 2026.2.22 in macOS node-host syst…7.5
• CVE-2026-2218A vulnerability was determined in D-Link DCS-933L up to 1.14…8.8
• CVE-2026-22180OpenClaw versions prior to 2026.3.2 contain a path-confineme…5.3
• CVE-2026-22181OpenClaw versions prior to 2026.3.2 contain a DNS pinning by…7.6
• CVE-2026-22182wpDiscuz before 7.6.47 contains an unauthenticated denial of…8.7
• CVE-2026-22183wpDiscuz before 7.6.47 contains a stored cross-site scriptin…5.4
• CVE-2026-22185OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up…4.6
• CVE-2026-22186Bio-Formats versions up to and including 8.3.0 contain an XM…7.1
• CVE-2026-22187Bio-Formats versions up to and including 8.3.0 perform unsaf…7.8
• CVE-2026-22188The deploy-stub component in Panda3D versions up to and incl…5.5
• CVE-2026-22189The egg-mkfont utility in Panda3D versions up to and includi…9.8
• CVE-2026-2219It was discovered that dpkg-deb (a component of dpkg, the De…7.5