(Sorry Claude wrote this, but if true thought it be helpful for ya'll,
thanks. CVEs this year have been insane!)
Hi,
CVE-2026-85091 is the heap overflow in gz_vacate() (gzwrite.c), reached
through gzprintf()/gzvprintf() after a non-blocking write stall. The
advisory (GHSA-g5fp-32jq-cfw2) gives the affected range as 1.3.1.2
through 1.3.2, and the upstream history agrees:
- gz_vacate() and the non-blocking handling in the gz* routines were
introduced in upstream commit 81cc0bebedd935daeb81b0b6e475d8786b51af3d
("Support non-blocking devices in the gz* routines.", 2025-05-25),
after the v1.3.1 tag. v1.3.1.2 is the first tag that contains it and
v1.3.2 (2026-02-17) the first release.
- gzwrite.c at v1.3.1 defines only gz_init, gz_comp, gz_zero and
gz_write. There is no gz_vacate() and no stall handling: a short or
failed write() is treated as a fatal Z_ERRNO.
The tracker currently lists trixie (1:1.3.dfsg+really1.3.1-1) and
bookworm (1:1.2.13.dfsg-1) as vulnerable. Both predate the vulnerable
code, so I believe they should be marked <not-affected> (vulnerable code
introduced in 1.3.2), leaving only 1:1.3.dfsg+really1.3.2-* in
forky/sid affected.
--
David Clausen
Platform - Principal Engineer
[email protected]
<http://www.arbol.io>
www.arbol.io [email protected] [image: twitter]
<https://twitter.com/arbolmarket> [image: linkedin]
<https://www.linkedin.com/company/arbolinc>
--
IMPORTANT: The information contained in this email and/or its attachments
is confidential. If you are not the intended recipient, please notify the
sender immediately by reply and immediately delete this message and all its
attachments. Any review, use, reproduction, disclosure or dissemination of
this message or any attachment by an unintended recipient is strictly
prohibited. Neither this message nor any attachment is intended as or
should be construed as an offer, solicitation or recommendation to buy or
sell any security, commodity interest, or other financial instrument.
Neither the sender, his or her employer nor any of their respective
affiliates makes any warranties as to the completeness or accuracy of any
of the information contained herein or that this message or any of its
attachments is free of viruses.
