Repository navigation
Update to zlib 1.4 to fix the following CVEs: - #281
Conversation
CVE-2026-85091 CVE-2026-4738 Signed-off-by: Loganaden Velvindron <[email protected]>
There was a problem hiding this comment.
🔵 Needs a closer look
The available material lacks a diff, changed-file list, and zlib source or patches, preventing verification of the proposed update and CVE fixes.
No open issues 🎉
What changed in this PR
This PR proposes upgrading zlib to 1.4 to address CVE-2026-85091 and CVE-2026-4738. No changed-file details were supplied, so the upgrade and its security impact could not be verified.
Changes:
- Intended update of the codebase’s zlib dependency to version 1.4.
| File | Description |
|---|
Review effort: Balanced
|
Thanks, this is a good one. I will see to cutting a new release. Details
The bump benefits builds that bundle stock zlib: libz-sys exposes gzwrite, so the non-blocking-write bug CVE-2026-85091 can apply, as can other core fixes in zlib 1.4. CVE-2026-4738 is in contrib/infback9, which this crate does not build or package; builds linking system zlib do not receive the bundled fixes. A static macOS build and all 264 ABI checks passed. |
CVE-2026-85091
CVE-2026-4738