A Massively Spiffy Yet Delicately Unobtrusive Compression Library
(Also Free, Not to Mention Unencumbered by Patents)

(Not Related to the Linux zlibc Compressing File-I/O Library)

Welcome to the zlib home page, web pages originally created by Greg Roelofs and maintained by Mark Adler. If this page seems suspiciously similar to the PNG Home Page, rest assured that the similarity is completely coincidental. No, really.

zlib was written by Jean-loup Gailly (compression) and Mark Adler (decompression).

Version 1.4 has these key updates from 1.3.2:

Breaking changes

• CMake:
  • The minimum CMake version is now 3.15, up from 3.12.
  • Library file names changed on MSVC: z is now libz, as in libz.dll, libz.lib, and the static libzs.lib. minizip's libraries changed the same way.
  • On Cygwin, the libraries now use the lib prefix.
  • Contrib targets and tests built as part of zlib are now prefixed with zlib_. Several test targets were renamed to one scheme, for example zlib_examplestatic and minigzipstatic.
  • The zlib1.dll option ENABLE_BZIP2 is now ZLIB1_DLL_ENABLE_BZIP2.
• When not otherwise determined, z_off_t is again long, as in 1.3.1, instead of 1.3.2's long long. Windows applications built with 1.3.2 headers should be recompiled; see Enhancements for 64-bit offsets.
• deflateReset() now resets the gzip header set by deflateSetHeader(), as zlib.h has always said. Code relying on the header persisting must set it again.
• Raw deflate that completes exactly at the end of the output buffer now returns Z_STREAM_END instead of Z_OK, as documented.
• gzopen() with "x" now fails where O_EXCL isn't available, instead of truncating an existing file (Trail of Bits TOB-ZLIB-009).
• gzip reading now delivers the data decompressed before a read error, and only then reports the error.

Security fixes

• Non-blocking gzwrite() had a buffer overflow; CVE-2026-85091 (reported by mat-mo; also TOB-ZLIB-003).
• inflateGetDictionary() could write up to 8 MB past the caller's 32K buffer (Theorem THM-ZLIB-001). This took a zlib header with an invalid window size, then inflateReset() or inflateSync(). Affects 1.2.8 through 1.3.2.
• inflateSync() before the window size was known allocated a one-byte window that could later be overrun (TOB-ZLIB-004).
• inflatePrime() could lead inflate() to read before the start of the input (TOB-ZLIB-014).
• Repeated deflatePrime() calls could write past the pending buffer (TOB-ZLIB-013).
• inflateBack() failed to detect distances too far back, and copied uninitialized memory to the output (reported by Kornel Lesiński).
• gzseek() forward before any data was written could write uninitialized memory to the gzip output (found by Claude Opus 5.5).
• deflateResetKeep() used mid-stream could read outside the window (reported by Jason Gross).
• gzdopen() now sets close-on-exec with the correct flag (TOB-ZLIB-008).
• minizip:
  • A double free in block_central_name() (reported by Oculytic), and a NULL dereference on repeated zipAlreadyThere() calls after a bad central directory (reported by Naveed Khan).
  • Validation of extra-field sizes, plus portable, alignment-safe reading, in zipRemoveExtraInfoBlock() (reported by Naveed Khan and jmestwa-coder).
  • unzip no longer reads Zip64 values from outside their extra-field record (reported by Mohamed Elnady). It also uses only the Zip64 locator immediately before the end of central directory record (reported by snajafov). Crafted archives could make minizip report different entries than other readers.
  • miniunz could create directories outside the extraction directory (reported by Naveed Khan), and on Windows write files anywhere (reported by Trail of Bits). Fixed by Naveed Khan. Path names are now processed by component.
• contrib/infback9: removed out-of-bounds pointer arithmetic in inftree9.c; CVE-2026-4738 (fix by npt-1707, submitted by CrossVR). The pointers return in bounds before use and no known compiler mishandles this, so the critical rating overstates it, though it could trap on capability hardware such as CHERI.

Bug fixes

• gzip reading:
  • Restored the detection of truncated gzip streams, part of which was lost in 1.3.2. Also fixed a complete stream being reported as truncated.
  • An error in the first member is no longer treated as trailing garbage.
  • Corrected pending-skip handling in gz_skip(), gzdirect() and forced seeks at EOF.
  • gzgets() now returns an empty string when promised.
• gzip writing:
  • Successive SEEK_CUR seeks no longer lose zero fill.
  • Zero fill is now handled correctly after a write error.
  • gzprintf() is now all-or-nothing when blocked, and is no longer a stub when compiled as C++.
  • gzseek() leaves the position unchanged on failure.
  • gzopen_w() now works with paths not representable in the locale.
• inflate:
  • total_in was short six bytes on Z_NEED_DICT.
  • inflateReset() now restores the requested window size, and the wrap after inflateSync().
  • inflateSetDictionary() rejects a null dictionary.
  • With PKZIP_BUG_WORKAROUND, the code tables were slightly too small.
• deflate:
  • A bad deflateSetDictionary() call is now detected as promised.
  • A failed deflateCopy() or inflateCopy() leaves the destination safe to end.
  • Removed a possible overflow in deflate_stored() comparisons.
• Undefined behavior removed in gzwrite.c, gzseek, gz_vacate() and mztools.c.
• minizip:
  • zip.c no longer writes corrupt headers when a Zip64 field overflows an extra field (reported by mzfr and itsgaldoron), or for Zip64 entries with file comments.
  • zipOpen3() no longer leaks memory or returns a freed comment pointer on failure.
  • Added allocation checks.
• Build:
  • configure now builds the shared library with linkers such as lld that reject undefined symbols in zlib.map, including for --solo.
  • zlib.h no longer depends on NULL being defined.
  • zip.c builds with NO_ADDFILEINEXISTINGZIP.
  • The test programs use the generated zconf.h when building out of tree.
• Many CMake fixes: pkg-config files, installation of headers and of minizip's configuration, symbol prefixing, assembler detection, and parallel testing. It also works with CMake 4.

Enhancements

• 64-bit offsets on Windows with MSVC or MinGW, by compiling the application with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE. The library itself needs no changes.
• Platforms:
  • Android large file support.
  • An export list on AIX.
  • -Wno-psabi, only where the PowerPC note would appear.
  • s390x VGFMAFLAG in configure.
  • Win32 Makefile.msc builds for ARM64.
  • minigzip's mmap code uses POSIX types.
• CMake:
  • Package components, with _FOUND variables.
  • Installation and export of zlib1.dll and zlibwapi.dll.
  • Contribs build standalone, with zlib's defaults.
  • Tests consolidated, and tests on Windows.
• minizip:
  • The traditional encryption header uses a PCG generator instead of rand().
  • Fewer compiler warnings.
• Documentation:
  • Clarified that undocumented functions are not part of the API.
  • inflateGetHeader() header reuse.
  • deflateBound() and deflateSetDictionary() ordering.
  • The application's responsibilities in unzip.h.

Known issues

• contrib/iostream2 is unsafe on untrusted input (reported by Trail of Bits). When reading a string, it uses the length stored in the compressed data without checking it, so a crafted file can write past the end of the destination buffer. Use contrib/iostream3 instead.

• Address findings of the 7ASecurity audit of zlib.
  • Check for negative lengths in crc32_combine functions.
  • Copy only the initialized window contents in inflateCopy.
  • Prevent the use of insecure functions without an explicit request.
  • Add compressBound_z and deflateBound_z functions for large values.
  • Use atomics to build inflate fixed tables once.
  • Add --undefined option to ./configure for UBSan checker.
  • Copy only the initialized deflate state in deflateCopy.
  • Zero inflate state on allocation.
  • Add compress_z and uncompress_z functions.
• Complete rewrite of cmake support.
• Remove untgz from contrib.
• Vectorize the CRC-32 calculation on the s390x.
• Remove vstudio projects in lieu of cmake-generated projects.
• Add zipAlreadyThere() to minizip zip.c to help avoid duplicates.
• Add deflateUsed() function to get the used bits in the last byte.
• Fix bug in inflatePrime() for 16-bit ints.
• Add a "G" option to force gzip, disabling transparency in gzread().
• Return all available uncompressed data on error in gzread.c.
• Support non-blocking devices in the gz* routines.

You can also look at the Change Log or the commit history.

Canonical URL: https://zlib.net/ (US)

zlib is designed to be a free, general-purpose, legally unencumbered -- that is, not covered by any patents -- lossless data-compression library for use on virtually any computer hardware and operating system. The zlib data format is itself portable across platforms. Unlike the LZW compression method used in Unix compress(1) and in the GIF image format, the compression method currently used in zlib essentially never expands the data. (LZW can double or triple the file size in extreme cases.) zlib's memory footprint is also independent of the input data and can be reduced, if necessary, at some cost in compression. A more precise, technical discussion of both points is available on another page.

zlib was written by Jean-loup Gailly (compression) and Mark Adler (decompression). Jean-loup is also the primary author of gzip(1), the author of the comp.compression FAQ list and the former maintainer of Info-ZIP's Zip; Mark is also the author of gzip's and UnZip's main decompression routines and was the original author of Zip. Not surprisingly, the compression algorithm used in zlib is essentially the same as that in gzip and Zip, namely, the `deflate' method that originated in PKWARE's PKZIP 2.x.

Mark can be reached via e-mail at . Please read the FAQ and the manual before asking for help. Nearly all of the questions we get already have an answer in the zlib documentation. Questions on the usage of zlib are best answered on Stack Overflow. zlib development contributions and issues are best addressed on zlib's GitHub repository.

The deflate and zlib specifications both achieved official Internet RFC status in May 1996, and zlib itself was adopted in version 1.1 of the Java Development Kit (JDK), both as a raw class and as a component of the JAR archive format.

The lovely zlib-vise image above was provided courtesy of Bruce Gardner, art director of Dr. Dobb's Journal. It appears in Mark Nelson's article in the January 1997 issue (see below).

The current release is publicly available here:

zlib source code, version 1.4, tar.gz format (1472K, SHA-256 hash 02dd159783677a749c04adbdd02b55b8a2bcc7e054f51b76b549199a916ad584):

US (zlib.net) (GPG signature)

zlib source code, version 1.4, tar.xz format (1289K, SHA-256 hash 4f11c512053d7bab8d9e9b89bde3575add3e4c50a383b42ef6cb837035fc5a7c):

US (zlib.net) (GPG signature)

zlib source code, version 1.4, zipfile format (1585K, SHA-256 hash 38bc7ed1c8ac3c870a159623deacf74a46c393ae1ad23f1dca1ed8e272deb058):

US (zlib.net) (GPG signature)

Permalink for the most recent release:

https://zlib.net/current/zlib.tar.gz

zlib Information

zlib Frequently Asked Questions

Zlib-announce mailing list

New versions of zlib are announced on this list.

Zlib-devel mailing list

Please do not send questions or comments about zlib to this mailing list. Send those directly to the authors at after checking the FAQ and the manual, of course. The zlib-devel list is for the development of zlib—members are contributors to and testers of new versions of zlib.

zlib Manual

zlib Usage Example

zlib Technical Details

zlib-related specifications:

• RFC 1950 ZLIB Compressed Data Format Specification version 3.3
• RFC 1951 DEFLATE Compressed Data Format Specification version 1.3
• RFC 1952 GZIP file format specification version 4.3

Deflate stream disassembler. infgen.c produces a readable description of a gzip, zlib, or raw deflate stream.

zlib's Deflate Algorithm

zlib's deflate flush modes

zlib License

All released versions of zlib

zlib on github

CRC (Cyclic Redundancy Check) Bonus Information

Ross Williams' classic "A Painless Guide to CRC Error Detection Algorithms"

Code to generate any CRC, with a list of CRC descriptions. crcany.c can take a description of a CRC and compute that CRC efficiently. It includes bit-wise, table-driven byte-wise, and table-driven word-wise CRC algorithms.

Code to modify a message so that it generates the desired CRC. spoof.c takes an abbreviated description of the CRC, the exclusive-or of the current CRC of the message and the desired CRC, the length of the message, and a list of bit locations in a message, and tells you which of those bits should be inverted in the message to get the desired CRC. Note that it does not need the message itself, due to the linearity property of CRCs.

ZIP File Processing Bonus Software

Code to read a zip file as a stream and extract its contents. sunzip.c will read a zip file from stdin and extract the files therein that use compression methods 0, 8, 9, or 12 (stored, deflate, deflate64, or bzip2). It accepts Zip64 input.

Code to merge multiple zip files into a single zip file. zipknit.c accepts Zip64 input files, and will create Zip64 output if the combined size of the merged zip file warrants it. All compression formats are permitted, since no decompression or recompression is performed. Encrypted entries are permitted, and pass through unscathed.

Related External Links

zlib for Linux, both shared and static plus headers (RPM format, many architectures)

zlib for Solaris (alternate)

zlib for macOS (Mac OS X): zlib is already included as part of macOS

zlib for Palm Pilot

zlib for Newton OS

zlib for Windows CE

zlib for Windows 9x/NT/2000/XP/2003 (DLL version, plus related utilities)

zlib for Windows 9x/NT (DLL and static version)

DotNetZip zip file manipulation for .NET, and more (including replacements for the buggy Microsoft GZipStream and DeflateStream classes)

zlib for .NET in C#

zlib DLL wrapper for .NET in C#

Zip for .NET

Mark Nelson's ZlibTool article (January 1997)

zlib C++ wrapper for the gz* functions.

C++ zlib and gzip filters in an iostream framework.

zlib 32-bit OCX (C++ source and binaries for use with Visual Basic 4.x or Delphi 2.0)

(unsupported VB5 binary also available)

zlib Delphi 5 interface

(includes compiled object files and corresponding C++ Builder 5 project files)

zlib Perl interface (source code; look for Compress-Zlib*.tar.gz)

zlib Python interface (online manual; part of the standard library as of Python 1.5)

zlib Tcl interface mkZiplib

zlib Haskell interface

zlib Java interface (see also JAR format)

zlib reimplementation in pure Java

(not tested by us, but looks like a good alternative to java.util.zip)

Random access for gzip archives, for Java

Gilles Vollant's zlib-based mini-zip and mini-unzip

(see also Info-ZIP's UnZip, which optionally can be compiled with zlib)

Scott Ludwig's zlib-based CExe executable compressor for Win32

zlib technical issues, including spec errors

Zip Files: History, Explanation and Implementation

zlib information in Japanese

zlib information in Russian

Real World Scanning and Halftones (second edition includes a section on zlib)

Markus Oberhumer's LZO `real-time' data compression library

(not tested by us, but looks like a good alternative if you need more speed and less compression)

lz4, a very fast compression algorithm

(not tested by us, but looks like an even better alternative if you need more speed and less compression)

Zstandard, a better compression algorithm

(not tested by us, but appears to be a better alternative to zlib in both dimensions of compression and speed, as well as decompression speed)

libbzip2

(not tested by us, but looks like a good alternative if you need more compression and less speed)

PPP Deflate Protocol (RFC 1979)

Info-ZIP Home Page

Portable Network Graphics (PNG) Home Page

gzip Home Page

pigz (parallel gzip) Home Page

DataCompression.info

comp.compression Frequently Asked Questions list

Send comments or questions about zlib to the authors at   after checking the FAQ and the manual.
Please report broken links to (PGP key).

This page last updated Nov 9^th, 2026.