Hello,
The tracker currently lists zlib as vulnerable to CVE-2026-85091 in
bookworm and trixie. As far as I can tell, neither release contains the
vulnerable code.
- The CVE covers zlib 1.3.1.2 through 1.3.2. The vulnerable function
gz_vacate() and the non-blocking write code came in with upstream commit
81cc0be ("Support non-blocking devices in the gz* routines", 25 May 2025).
That commit is in v1.3.1.2 but not in v1.3.1.
- trixie (1:1.3.dfsg+really1.3.1-1) ships upstream 1.3.1 with no Debian
patches. Its gzwrite.c has no gz_vacate().
https://sources.debian.org/src/zlib/1:1.3.dfsg+really1.3.1-1/gzwrite.c/
- bookworm (1:1.2.13.dfsg-1) predates the commit as well.
- forky/sid (1:1.3.dfsg+really1.3.2-3) does contain the code (gz_vacate()
at line 382), so it remains affected:
https://sources.debian.org/src/zlib/1:1.3.dfsg+really1.3.2-3/gzwrite.c/
Upstream discussion: https://github.com/madler/zlib/issues/1310
If the analysis above is correct, could you please mark bookworm and trixie
as not-affected?
Thank you,
Dimitris
