Hi, I agree with Salvatore.
Additionally I was able to create an poc [1] that crashes even when not using the non-blocking API. The mechanics for the crash are the same as for the non-blocking poc, namely a crash due the invalid state. The crash goes away with the upstream fix for CVE-2026-85091 [2], [1] https://github.com/madler/zlib/issues/1292#issuecomment-597805192 [2] https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148 Whether this will have a dedicated CVE will depend on upstream view on this issue. Cheers, tobi
