CVE-2026-27171
Low · 2.9CVSS
2.9
EPSS
0.2%
Published
Feb 18, 2026
CISA due date
—
The record
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | zlib | 0 | 1.3.2-r0 |
| Chainguard | zlib-dev | 0 | 1.3.2-r0 |
| SUSE:Linux Enterprise Micro 5.5 | zlib | 0 | 1.2.13-150500.4.6.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | zlib | 0 | 1.2.13-150500.4.6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | zlib | 0 | 1.2.13-150500.4.6.1 |
| Wolfi | zlib | 0 | 1.3.2-r0 |
| Wolfi | zlib-dev | 0 | 1.3.2-r0 |
| openSUSE:Leap 15.6 | zlib | 0 | 1.2.13-150500.4.6.1 |
| openSUSE:Leap 16.0 | zlib | 0 | 1.2.13-160000.3.1 |
| openSUSE:Tumbleweed | zlib | 0 | 1.3.1-2.1 |
Related vulnerabilities
- CVE-2026-22184 zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz… Also affects zlib
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284
- CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write data… CWE-1284
- CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… CWE-1284
- CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value in… CWE-1284
- CVE-2026-87962 t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in… CWE-1284
- CVE-2026-87735 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. CWE-1284
- CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36… CWE-1284