CVE-2023-6992: Memory corruption issues is Cloudflare zlib implementation

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-04 · updated 2026-06-17
Weakness: CWE-20

Description

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Affected products

Cloudflare Zlib: before 2023-11-16 — fixed in 2023-11-16

How to fix

Upgrade to a fixed version: Cloudflare Zlib 2023-11-16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6992 or the next vulnerability affects your stack