Hi,
On Fri, Oct 02, 2026 at 01:46:20PM +0300, Dimitris Nikolakakos wrote:
> Hello,
>
> The tracker currently lists zlib as vulnerable to CVE-2026-85091 in
> bookworm and trixie. As far as I can tell, neither release contains the
> vulnerable code.
>
> - The CVE covers zlib 1.3.1.2 through 1.3.2. The vulnerable function
> gz_vacate() and the non-blocking write code came in with upstream commit
> 81cc0be ("Support non-blocking devices in the gz* routines", 25 May 2025).
> That commit is in v1.3.1.2 but not in v1.3.1.
> - trixie (1:1.3.dfsg+really1.3.1-1) ships upstream 1.3.1 with no Debian
> patches. Its gzwrite.c has no gz_vacate().
> https://sources.debian.org/src/zlib/1:1.3.dfsg+really1.3.1-1/gzwrite.c/
> - bookworm (1:1.2.13.dfsg-1) predates the commit as well.
> - forky/sid (1:1.3.dfsg+really1.3.2-3) does contain the code (gz_vacate()
> at line 382), so it remains affected:
> https://sources.debian.org/src/zlib/1:1.3.dfsg+really1.3.2-3/gzwrite.c/
>
> Upstream discussion: https://github.com/madler/zlib/issues/1310
>
> If the analysis above is correct, could you please mark bookworm and trixie
> as not-affected?
No, we won't mark it yet as such. The reasons are explained in
https://github.com/madler/zlib/issues/1310#issuecomment-5979623265 ,
https://github.com/madler/zlib/issues/1292#issuecomment-5562455575 and
https://bugs.debian.org/1146895#36 .
So it will depends if upstream will consider this a separate issue or
in scope of the assignment.
Regards,
Salvatore
