RHSA-2026:61623MediumCVSS 6.0

Red Hat Security Advisory: gzip security update

Published
August 31, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (2)

CVE-2026-41992 →CVE-2026-41991 →

📋 Description

CVE-2026-41991 — gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41992 — gzip: gzip: Information disclosure via global buffer overflow in LZH decompression

🎯 Affected products14

  • Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-0:1.12-2.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debuginfo-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debuginfo-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debuginfo-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debuginfo-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debugsource-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debugsource-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debugsource-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • gzip-debugsource-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Ensure that the mktemp utility (provided by the coreutils package) is available in PATH when using the gzexe utility. On Red Hat Enterprise Linux, mktemp is installed by default and no additional action is needed.

🔗 References (4)