CVE-2026-27171
CVE-2026-27171
This page contains facts from public vulnerability sources. Check the original advisory before updating.
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
CVSS 2.9 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
zlib
- Versions
- ≥ 0, < 1.3.2: Affected (semver)
Update to 1.3.2
zlib Debian:12
- Versions
- 1:1.2.13.dfsg-1
- 1:1.2.13.dfsg-2
- 1:1.2.13.dfsg-3
- 1:1.3.dfsg+really1.3.1-1
- 1:1.3.dfsg+really1.3.1-2
- 1:1.3.dfsg+really1.3.1-3
- 1:1.3.dfsg+really1.3.2-1
- 1:1.3.dfsg+really1.3.2-2
- 1:1.3.dfsg+really1.3.2-3
- 1:1.3.dfsg-1
- 1:1.3.dfsg-2
- 1:1.3.dfsg-3
- 1:1.3.dfsg-3.1
- 1:1.3.dfsg-3.1~exp1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
zlib Debian:13
- Versions
- 1:1.3.dfsg+really1.3.1-1
- 1:1.3.dfsg+really1.3.1-2
- 1:1.3.dfsg+really1.3.1-3
- 1:1.3.dfsg+really1.3.2-1
- 1:1.3.dfsg+really1.3.2-2
- 1:1.3.dfsg+really1.3.2-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
zlib Debian:14
- Versions
- 1:1.3.dfsg+really1.3.1-1
- 1:1.3.dfsg+really1.3.1-2
- 1:1.3.dfsg+really1.3.1-3
- Affected ranges
- ECOSYSTEM: < 1:1.3.dfsg+really1.3.2-1
Update to 1:1.3.dfsg+really1.3.2-1
zlib Ubuntu:24.04:LTS
- Versions
- 1:1.2.13.dfsg-1ubuntu5
- 1:1.3.dfsg-3ubuntu1
- 1:1.3.dfsg-3.1ubuntu1
- 1:1.3.dfsg-3.1ubuntu2
- 1:1.3.dfsg-3.1ubuntu2.1
- Affected ranges
- ECOSYSTEM: < 1:1.3.dfsg-3.1ubuntu2.2
Update to 1:1.3.dfsg-3.1ubuntu2.2
zlib Ubuntu:25.10
- Versions
- 1:1.3.dfsg+really1.3.1-1ubuntu1
- 1:1.3.dfsg+really1.3.1-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
zlib Ubuntu:26.04:LTS
- Versions
- 1:1.3.dfsg+really1.3.1-1ubuntu2
- 1:1.3.dfsg+really1.3.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: < 1:1.3.dfsg+really1.3.1-1ubuntu3.1
Update to 1:1.3.dfsg+really1.3.1-1ubuntu3.1