CVE-2009-2624: GNU Gzip

Medium severity, CVSS 6.8. EPSS: 4.2% chance of exploitation in the next 30 days.

The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.

Affected products

• GNU Gzip: up to and including 1.3.12; version 1.2.4 only; version 1.2.4a only; version 1.3 only; version 1.3.1 only; version 1.3.2 only; …

Published 2010-01-29. Last modified 2026-06-16.