[PATCH v2 1/2] zlib: upgrade 1.3.2 -> 1.4

[PATCH v2 1/2] zlib: upgrade 1.3.2 -> 1.4

[Prasanth R]

Bug fix and security release. It fixes CVE-2026-85091, a heap buffer
overflow in gzwrite(), and several inflate, deflate and gzread issues.

Drop the -fuse-ld=bfd workaround. 1.4 fixes the configure test that
failed with lld 17+ (upstream commit 6ddc2d0, "Fix configure when using
zlib.map with some linkers"). PR #936, named in the old comment, is
about --zprefix builds, which we don't use.

License checksum is unchanged.

Changelog: https://github.com/madler/zlib/blob/v1.4/ChangeLog

AI-Generated: Uses Claude
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
---

Notes:
    v2: zlib 1.4 is out, so upgrade instead of the backport (Peter), and
    mark CVE-2026-76844 cpe-incorrect in a separate patch (Paul).
    Also drop the lld workaround: tested a 1.4 build with gcc + ld.lld,
    same exported symbols as with bfd. ptest passes on Test.

 meta/recipes-core/zlib/{zlib_1.3.2.bb => zlib_1.4.bb} | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
 rename meta/recipes-core/zlib/{zlib_1.3.2.bb => zlib_1.4.bb} (85%)

diff --git a/meta/recipes-core/zlib/zlib_1.3.2.bb b/meta/recipes-core/zlib/zlib_1.4.bb
similarity index 85%
rename from meta/recipes-core/zlib/zlib_1.3.2.bb
rename to meta/recipes-core/zlib/zlib_1.4.bb
index 8a23d98cd3..18b27df878 100644
--- a/meta/recipes-core/zlib/zlib_1.3.2.bb
+++ b/meta/recipes-core/zlib/zlib_1.4.bb
@@ -12,16 +12,13 @@ SRC_URI = "https://zlib.net/${BP}.tar.gz \
            "
 UPSTREAM_CHECK_URI = "http://zlib.net/"
 
-SRC_URI[sha256sum] = "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16"
+SRC_URI[sha256sum] = "02dd159783677a749c04adbdd02b55b8a2bcc7e054f51b76b549199a916ad584"
 
 # When a new release is made the previous release is moved to fossils/, so add this
 # to PREMIRRORS so it is also searched automatically.
 PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/"
 
 CFLAGS += "-D_REENTRANT -fPIE"
-# zlib does not build with lld, keep it until https://github.com/madler/zlib/pull/936
-# is addressed
-LDFLAGS:append = " -fuse-ld=bfd"
 
 RDEPENDS:${PN}-ptest += "make"
 
-- 
2.34.1

[PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Prasanth R]

CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib
gz_vacate details by mistake; the zlib CVE for that bug is
CVE-2026-85091 [1].

[1] https://github.com/madler/zlib/issues/1330

AI-Generated: Uses Claude
Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
---
 meta/recipes-core/zlib/zlib_1.4.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-core/zlib/zlib_1.4.bb b/meta/recipes-core/zlib/zlib_1.4.bb
index 18b27df878..2bc1967c0e 100644
--- a/meta/recipes-core/zlib/zlib_1.4.bb
+++ b/meta/recipes-core/zlib/zlib_1.4.bb
@@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk"
 
 # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
 CVE_PRODUCT = "zlib:zlib gnu:zlib"
+
+CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for webpack-dev-middleware, the zlib details were added in error"
-- 
2.34.1

RE: [PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Marko, Peter]

zlib recipe version 1.4 does not assert this CVE as unpatched.
I think it's not worth to carry patches which just switch patched:fixed-version to patched:cpe-incorrect.

Peter

> -----Original Message-----
> From: Prasanth R <ragaprasanth@gmail.com>
> Sent: Friday, November 6, 2026 2:13 AM
> To: openembedded-core@lists.openembedded.org
> Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1)
> <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com>
> Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844
> 
> CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib
> gz_vacate details by mistake; the zlib CVE for that bug is
> CVE-2026-85091 [1].
> 
> [1] https://github.com/madler/zlib/issues/1330
> 
> AI-Generated: Uses Claude
> Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
> ---
>  meta/recipes-core/zlib/zlib_1.4.bb | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/meta/recipes-core/zlib/zlib_1.4.bb b/meta/recipes-core/zlib/zlib_1.4.bb
> index 18b27df878..2bc1967c0e 100644
> --- a/meta/recipes-core/zlib/zlib_1.4.bb
> +++ b/meta/recipes-core/zlib/zlib_1.4.bb
> @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk"
> 
>  # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
>  CVE_PRODUCT = "zlib:zlib gnu:zlib"
> +
> +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for webpack-dev-
> middleware, the zlib details were added in error"
> --
> 2.34.1

Re: [PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Prasanth Ramesh]

[-- Attachment #1: Type: text/plain, Size: 1818 bytes --]

Hi Peter,

Makes sense for 1.4. I think we can drop patch 2/2, as patch 1/2 doesn't
depend on it.
I'll add the CVE_STATUS to the backport branches instead, if needed, there.

Thanks,
Prasanth


On Fri, Nov 6, 2026 at 3:53 PM Marko, Peter <Peter.Marko@siemens.com> wrote:

> zlib recipe version 1.4 does not assert this CVE as unpatched.
> I think it's not worth to carry patches which just switch
> patched:fixed-version to patched:cpe-incorrect.
>
> Peter
>
> > -----Original Message-----
> > From: Prasanth R <ragaprasanth@gmail.com>
> > Sent: Friday, November 6, 2026 2:13 AM
> > To: openembedded-core@lists.openembedded.org
> > Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1)
> > <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com>
> > Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844
> >
> > CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib
> > gz_vacate details by mistake; the zlib CVE for that bug is
> > CVE-2026-85091 [1].
> >
> > [1] https://github.com/madler/zlib/issues/1330
> >
> > AI-Generated: Uses Claude
> > Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
> > ---
> >  meta/recipes-core/zlib/zlib_1.4.bb | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/meta/recipes-core/zlib/zlib_1.4.bb
> b/meta/recipes-core/zlib/zlib_1.4.bb
> > index 18b27df878..2bc1967c0e 100644
> > --- a/meta/recipes-core/zlib/zlib_1.4.bb
> > +++ b/meta/recipes-core/zlib/zlib_1.4.bb
> > @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk"
> >
> >  # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
> >  CVE_PRODUCT = "zlib:zlib gnu:zlib"
> > +
> > +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for
> webpack-dev-
> > middleware, the zlib details were added in error"
> > --
> > 2.34.1
>
>

[-- Attachment #2: Type: text/html, Size: 3201 bytes --]

Re: [PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Prasanth Ramesh]

[-- Attachment #1: Type: text/plain, Size: 2036 bytes --]

Hi Paul,

are you ok with dropping 2/2?

Thanks,
Prasanth


On Fri, Nov 6, 2026 at 5:13 PM Prasanth Ramesh <ragaprasanth@gmail.com>
wrote:

> Hi Peter,
>
> Makes sense for 1.4. I think we can drop patch 2/2, as patch 1/2 doesn't
> depend on it.
> I'll add the CVE_STATUS to the backport branches instead, if needed, there.
>
> Thanks,
> Prasanth
>
>
> On Fri, Nov 6, 2026 at 3:53 PM Marko, Peter <Peter.Marko@siemens.com>
> wrote:
>
>> zlib recipe version 1.4 does not assert this CVE as unpatched.
>> I think it's not worth to carry patches which just switch
>> patched:fixed-version to patched:cpe-incorrect.
>>
>> Peter
>>
>> > -----Original Message-----
>> > From: Prasanth R <ragaprasanth@gmail.com>
>> > Sent: Friday, November 6, 2026 2:13 AM
>> > To: openembedded-core@lists.openembedded.org
>> > Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1)
>> > <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com>
>> > Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844
>> >
>> > CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib
>> > gz_vacate details by mistake; the zlib CVE for that bug is
>> > CVE-2026-85091 [1].
>> >
>> > [1] https://github.com/madler/zlib/issues/1330
>> >
>> > AI-Generated: Uses Claude
>> > Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
>> > ---
>> >  meta/recipes-core/zlib/zlib_1.4.bb | 2 ++
>> >  1 file changed, 2 insertions(+)
>> >
>> > diff --git a/meta/recipes-core/zlib/zlib_1.4.bb
>> b/meta/recipes-core/zlib/zlib_1.4.bb
>> > index 18b27df878..2bc1967c0e 100644
>> > --- a/meta/recipes-core/zlib/zlib_1.4.bb
>> > +++ b/meta/recipes-core/zlib/zlib_1.4.bb
>> > @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk"
>> >
>> >  # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
>> >  CVE_PRODUCT = "zlib:zlib gnu:zlib"
>> > +
>> > +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for
>> webpack-dev-
>> > middleware, the zlib details were added in error"
>> > --
>> > 2.34.1
>>
>>

[-- Attachment #2: Type: text/html, Size: 3800 bytes --]

Re: [PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Paul Barker]

On Fri Nov 6, 2026 at 8:28 AM GMT, Prasanth Ramesh wrote:
> Hi Paul,
>
> are you ok with dropping 2/2?

Hi Prasanth,

https://app.opencve.io/cve/CVE-2026-76844 still shows this as a zlib
CVE, but unaffected after v1.3.2. So yes, this can probably be dropped.
Hopefully the upstream data will get fixed soon.

Best regards,

-- 
Paul Barker

Re: [PATCH v2 2/2] zlib: ignore CVE-2026-76844

[Prasanth Ramesh]

[-- Attachment #1: Type: text/plain, Size: 160 bytes --]

👍

Prasanth Ramesh reacted via Gmail
<https://www.google.com/gmail/about/?utm_source=gmail-in-product&utm_medium=et&utm_campaign=emojireactionemail#app>

[-- Attachment #2: Type: text/vnd.google.email-reaction+json, Size: 40 bytes --]

{
  "emoji": "👍",
  "version": 1
}

[-- Attachment #3: Type: text/html, Size: 292 bytes --]