Debian 13 zlib: CVE-2026-76844 title collision and CVE-2026-85091 affected-range discrepancy

[HasaraDA]

Debian 13 amd64 package zlib1g 1:1.3.dfsg+really1.3.1-1+b1 triggered two HIGH findings. This is not a request for an exception.

• CVE-2026-76844: The package attribution to zlib is correct, but the display title says webpack-dev-middleware path traversal. The current CNA record describes a zlib stale gzip writer pointer after a failed write (1.2.11–1.3.2). Debian #1153063 reproduces it on 1.3.1 after a failed write and gzclearerr(). Please keep the finding and review the metadata selection: the reviewed webpack advisory still uses the same identifier.
• CVE-2026-85091: The CNA record names gz_vacate() on 1.3.1.2–1.3.2. All five gzip files in the exact Trixie source match upstream v1.3.1 byte-for-byte, with neither gz_vacate nor state->again. Debian #1146895 already documents the affected-range question. Debian still lists Trixie as affected, so this is a vendor data question, not a local ignore request.

Public evidence: compare the Debian source and binary archives for source 1:1.3.dfsg+really1.3.1-1 and binary 1:1.3.dfsg+really1.3.1-1+b1 against upstream v1.3.1. The amd64 .deb SHA-256 is 015be740d6236ad114582dea500c1d907f29e16d6db00566ca32fb68d71ac90d; extracted libz.so.1.3.1 SHA-256 is 85590dd58edf5445e18bc7193e5ebc01ac5841f1ae187e97705a662e90c6421e. The library bytes match the public linux/amd64 Distroless base gcr.io/distroless/nodejs24-debian13:nonroot@sha256:a6c34457f6da4295807e051411c7783739c65b997a324fed14e4fa292615ae91 (layer sha256:cac2ae0193cb073e7492050b05fc342a888651b4bbc966908c8793f889c299ba).

Observed in derivatives of that base with aquasec/trivy@sha256:8f6bb947dbc528902e11f2f5be52f7b519f6a39d5d148f41166f2040499768fb on 2026-11-06 using image --severity HIGH,CRITICAL --exit-code 1. A refreshed database may render this differently.