Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
CVE-2026-22184 does not affect libsurvive, so there is nothing to fix in this package. The CVE is a buffer overflow in zlib's untgz utility. TGZfname() writes out of bounds when an archive name is longer than 1024 bytes. For libsurvive: - No untgz code: the tree at 23f0366 has no untgz or TGZfname anywhere, and it doesn't vendor zlib or any zlib contrib files. It only used redist/puff.c, which is Mark Adler's tiny inflate and not part of this issue. That file is also no longer built, as of the latest Rawhide push. - No untgz in the build: libsurvive links -lz and uses inflate and crc32. The spec doesn't ship or call the untgz binary. - Fedora's zlib: the build uses zlib-ng-compat, and its -devel package doesn't contain untgz. Any fix for Fedora's zlib belongs in that package, not in libsurvive.