Repository navigation
Zlib vulnerabilities via Flutter dependency #182018
Description
Hello,
A security scan on a mobile application identified a vulnerability affecting the zlib library.
Affected CVE:
This vulnerability is related to a global buffer overflow in the standalone untgz utility included in the zlib source tree.
Current situation:
- The application indirectly uses zlib through the Flutter framework and its native dependencies. and libs like archive and image.
- The security scanner detected zlib version 1.3.0.1.
- Security scanners report that zlib versions < 1.3.1.3 are affected by CVE-2026-22184.
- The zlib version cannot be updated independently by the application, as it is managed by Flutter
Impact and Severity:
According to public advisories, the vulnerability may lead to:
- Buffer overflow
- Application crash (Denial of Service)
- Potential memory corruption or code execution under specific conditions
Questions:
- Is there a planned update of the Flutter Engine that includes zlib version 1.3.1.3 or newer, addressing CVE-2026-22184?
- Is there any official guidance or recommendation from the Flutter team to address or formally suppress this CVE in security scans until an engine update is available?
References:
Activity
mbcorona commentedon Feb 17, 2026
Thanks for reporting @matheusmourafpf
This is a request to update the internal zlib dependency in the Flutter Engine (currently 1.3.0.1) to version 1.3.1.3 or newer to address CVE-2026-22184 flagged by security scanners.
Labeling for team-engine.
Roll zlib to 7eda07b1e067
jason-simmons commentedon Feb 20, 2026
Flutter obtains zlib from a repository maintained by Chromium (see https://chromium.googlesource.com/chromium/src/third_party/zlib/). That version of zlib does not include the "untgz" code which is affected by the CVE.
I've created a PR to roll zlib to the current head of Chromium's main branch (#182692). However, that tree was most recently synced with zlib 1.3.1.1. So it may be mismatched if a scanner is specifically looking for 1.3.1.3.
Roll zlib to 7eda07b1e067 (#182692)
Roll zlib to 7eda07b1e067 (flutter#182692)
Roll zlib to 7eda07b1e067 (flutter#182692)
Roll zlib to 7eda07b1e067 (flutter#182692)
CGseng commentedon Apr 2, 2026
Roll zlib to 7eda07b1e067 (#182692)