CVE Feed

    Dashboard / CVE / CVE-2026-27171

    CVE-2026-27171

    zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

    Published:Feb 18, 2026
    Last Modified:Apr 17, 2026
    EPS:Feb 18, 2026
    EPSS Score:0.00007
    CVSS Score:2.9

    Affected Products

    Vendor
    Zlib
    Product
    Zlib

    Exploits

    https://github.com/madler/zlib/issues/904

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-85091 (CVSS 8.3) — zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function w…
    CVE-2026-22184 (CVSS 4.6) — zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under …
    CVE-2025-0725 (CVSS 7.3) — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURL…
    CVE-2023-45853 (CVSS 9.8) — MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFile…
    CVE-2022-37434 (CVSS 9.8) — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large g…
    CVE-2018-25032 (CVSS 7.5) — zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist…
    CVE-2016-9843 (CVSS 9.8) — The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified im…
    CVE-2016-9840 (CVSS 8.8) — inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impr…
    CVE-2016-9841 (CVSS 9.8) — inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impro…
    CVE-2016-9842 (CVSS 8.8) — The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecifie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High