This page contains a list of known audits (generally, though not necessarily, fuzzing) of compression codecs, conducted both as part of this project and by others. It will probably never be exhaustive, but we will try to come as close as we can.

Possible values for the status column are:

• Unknown — there is insufficient information available to come to a conclusion. You can think of it as a "TODO" item for us to fuzz, or "Help Wanted".
• OK — the implementation has been tested and no issues were found. Note that this doesn't necessarily mean no issues were present, merely that we have no security-related grounds to recommend against using the codec.
• Undisclosed — vulnerabilities exist, but have not yet been disclosed to anyone other than the author.
• Vulnerable — vulnerabilities have been publicly disclosed, but the code has not been fixed yet.
• Abandoned — there are known vulnerablities, but the project is no longer active and is unlikely to receive any security fixes.

Note that "OK" doesn't mean "no issues", it means there has been at least one attempt at fuzzing, and that there are currently no known issues.

[1] ZPAQ allows the user to embed a decompressor written in ZPAQL in the archive. This lets people experiment with new algorithms while maintaining compatibility with stock ZPAQ, but it means it is possible to create a decompressor with an infinite loop, and it is impossible for ZPAQ to detect.