Moderate Security Update for gzip Package: Addressing Arbitrary File Overwrite and Information Disclosure
Summary
ALSA-2026:61623: Moderate: gzip security update. Affects gzip versions < 1.12-2.el9_8. Fixed in 1.12-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gzip package, a widely used data compression utility, allows users to compress regular files into .gz format while preserving file attributes such as ownership, access, and modification times. This utility is integral in various applications for efficient file storage and transfer. However, vulnerabilities in its implementation can lead to significant security risks.
Vulnerability Detail
The gzip package has two critical vulnerabilities: CVE-2026-41991, which allows arbitrary file overwrite due to insecure temporary file handling in the gzexe utility, and CVE-2026-41992, which leads to information disclosure via a global buffer overflow during LZH decompression. These vulnerabilities can be exploited by attackers to overwrite sensitive files or disclose confidential information, posing a serious threat to system integrity and data security.
How To Fix
Minimum fixed version
1.12-2.el9_8
This is the first release that contains the fix.
sudo dnf update gzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the gzexe utility until the package is updated. Additionally, ensure that file permissions are set correctly to limit access to sensitive files.
Conclusion
The gzip package has been identified with moderate vulnerabilities that could lead to serious security issues. It is crucial to update the package to the latest version to mitigate these risks. Users should also consider temporary workarounds until the update can be applied.
See every vulnerability recorded for gzip →
FAQ
CVE-2026-41991 allows attackers to overwrite arbitrary files, which can lead to data loss or system compromise.
CVE-2026-41992 can lead to information disclosure, potentially exposing sensitive data to unauthorized users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, refrain from using the gzexe utility and ensure proper file permissions to mitigate risks.
For more details, refer to the CVE pages linked in the vulnerability report or consult security advisories related to gzip.
Related vulnerabilities
Recent vulnerabilities recorded for gzip.
