CVE-2009-2624
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table...
CVE-2009-2624 is a medium vulnerability (CVSS 6.8) in Gnu Gzip, published January 20, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.18%, the 90th percentile. Fixed in gzip 1.3.12-8.
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
Exploit likelihood
What each source reports
NVD Score used
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
CVE-2009-2624- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
CVE-2009-2624- Updated
- 2026-11-02
EUVDEUVD-2009-2619 No score
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
EUVD-2009-2619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx63-8q93-pfr5 No score
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table...
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
GHSA-fx63-8q93-pfr5- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
CVE-2009-2624- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2624 No score
The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
- Record
DEBIAN-CVE-2009-2624- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10059-1 No score
gzip-1.8-1.29 on GA media
These are all security issues fixed in the gzip-1.8-1.29 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10059-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gzipDebian:12 |
before 1.3.12-8 | 1.3.12-8 |
gzipDebian:13 |
before 1.3.12-8 | 1.3.12-8 |
gzipDebian:14 |
before 1.3.12-8 | 1.3.12-8 |
gzipDebian:4.0 |
before 1.3.5-15+etch1, plus listed versions 1.3.5-15 |
1.3.5-15+etch1 |
gzipDebian:5.0 |
before 1.3.12-6+lenny1, plus listed versions 1.3.12-6 |
1.3.12-6+lenny1 |
gzipopenSUSE:Tumbleweed |
before 1.8-1.29 | 1.8-1.29 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
support.apple.com/kb/HT4435
vupen.com/english/advisories/2010/0185
ubuntu.com/usn/USN-889-1
bugzilla.redhat.com/show_bug.cgi?id=514711
article.gmane.org/gmane.comp.gnu.gzip.bugs/258
lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
Show 13 moreShow less
debian.org/security/2010/dsa-1974
mandriva.com/security/advisories?name=MDVSA-2010:020
git.savannah.gnu.org/cgit/gzip.git/commit?id=39a362ae9d9b007473381dba5032f4dfc1744cf2
secunia.com/advisories/38223
lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=507263
nvd.nist.gov/vuln/detail/CVE-2009-2624
github.com/advisories/GHSA-fx63-8q93-pfr5
security-tracker.debian.org/tracker/CVE-2009-2624
suse.com/security/cve/CVE-2009-2624