Skip to content

CVE-2022-37434

Out-of-bounds Write: Is CVE-2022-37434 real, exploitable, or a false positive? Here's the community verdict.

signals

public sources

Exploited in wild
Not listed
CISA KEV
Public exploit
PoC (unverified)
Metasploit/EDB/PoC
Base severity
9.8 Critical
CVSS
Exploitation prob.
16%
FIRST EPSS
Weakness
CWE-787 · Out-of-bounds Write
CWE

Moderate signals. Triage by your actual exposure and reachability.

public exploits

links to sources — we don’t host code

Unverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.

baseline read

auto · not a community verdict

Low signal — verdict needed

Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.

Based on CVSS · FIRST EPSS

Confirm or dispute →

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Published

Embed this verdict
TruePositive verdict for CVE-2022-37434
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2022-37434/badge.svg)](https://www.truepositive.app/cve/CVE-2022-37434)
HTML
<a href="https://www.truepositive.app/cve/CVE-2022-37434"><img src="https://www.truepositive.app/cve/CVE-2022-37434/badge.svg" alt="TruePositive verdict for CVE-2022-37434"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

Be the first practitioner to weigh in

So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.

🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.

In your experience, is this finding real and exploitable?

awaiting field verdicts
Real, but not a risk here
Not a real issue

Curated baseline: TruePositive's read from public sources is Couldn't reproduce — a starting point, not a community verdict.

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

  • 0
    Field note · TruePositive EditorialCurated

    This is a real heap buffer over-read in zlib's inflate function, but it is only reachable when the application calls inflateGetHeader and then processes a gzip stream with an oversized header extra field. The vast majority of zlib users decompress data without ever calling inflateGetHeader, so the vulnerable path is dead for them even though scanners flag every pre-1.2.13 zlib.

    How to check: search for inflateGetHeader use in your code. If it is not called, you cannot reach the bug.

    Commonly flagged by: Trivy, Grype, Dependabot, OSV-Scanner.

  • 0
    Field note · TruePositive EditorialCurated

    The other side: for the small number of programs that do use inflateGetHeader with a custom extra-field buffer, this is a genuine memory-safety bug, so it is worth fixing there. The cannot-reproduce verdict reflects the common case, not those specific callers.

  • 0
    Remediation · TruePositive EditorialCurated

    Update zlib to 1.2.13 or later, which is cheap and worth doing as hygiene. Prioritize it only if you actually use inflateGetHeader, otherwise treat it as a low-urgency version bump.

Add a field note or remediationoptional
Note type

What are you adding?

Markdown supported · minimum 20 characters.

Same weakness: CWE-787 · Out-of-bounds Write.