Race Condition Affecting zlib package, versions [,1.3.2)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-ZLIB-20840331
- published12 Oct 2026
- disclosed18 Feb 2026
- creditUnknown
Introduced: 18 Feb 2026
CVE NOT AVAILABLE CWE-362 (opens in a new tab)How to fix?
Upgrade zlib to version 1.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Race Condition in the fixedtables function in inflate.c and infback.c, where the lazy build of the fixed Huffman tables is guarded by a static virgin flag and writes into static arrays with no synchronization. An attacker can corrupt those shared tables for the remaining lifetime of the process by driving concurrent first decompressions of streams containing fixed-Huffman blocks (BTYPE=01), so that one thread clears virgin while another is still populating the arrays. The build must define the non-default BUILDFIXED option, and because the flag is one way the tables are never rebuilt, leaving fixed-Huffman decompression broken or the process crashing until it is restarted.
Note: This cannot be triggered by compressed input alone. fixedtables is reached by any fixed-Huffman block, but the fault also needs the non-default BUILDFIXED flag and a concurrent first use, which the data cannot supply. A comment at inflate.c:249-251 states that BUILDFIXED is not for threaded programs.