[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (zlib 1.4 release notes / GitHub release, published Nov 5 UTC; notes dated Nov 4); no exploitation reported

zlib 1.4 fixes a stack of memory bugs, including a non-blocking gzwrite() buffer overflow (CVE-2026-85091) and an inflateGetDictionary() overrun of up to 8 MB

  • Upgrade: move applications and images that ship or statically link zlib/minizip to 1.4. Distro packages will lag; check your base images and language runtimes that vendor zlib.
  • Highest-impact callers: anything that decompresses untrusted gzip/deflate (HTTP clients, package managers, backup tools, document parsers) and anything that uses minizip on untrusted archives.
  • Breaking changes to watch: MSVC library names (libz), deflateReset() now clears a gzip header set by deflateSetHeader(), and raw deflate that finishes exactly at the output buffer end returns Z_STREAM_END instead of Z_OK.

Sources: zlib 1.4 GitHub release notes · oss-security: zlib 1.4 released with security fixes (Alan Coopersmith, Nov 5)