PatchTheCVEgzip vulnerabilities and fixes
Recent CVEs affecting gzip, with upgrade or downgrade steps. 2 tracked.
gzip has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-06-29. Highest priority: CVE-2026-41992 (score 44/100).
- CVE-2026-41992 HIGH 7.5 UPGRADE GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reu
- CVE-2026-41991 MEDIUM 4.7 UPGRADE GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling
FAQ
How do I fix gzip vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gzip being exploited right now?
None of the tracked gzip CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gzip CVE should I patch first?
CVE-2026-41992 currently ranks highest (44/100): GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reu.