CVE-2026-27171

State: Published
Severity: 2.9 Low
Published: Feb 18, 2026
Updated: Feb 18, 2026
Reserved: Feb 18, 2026

Description

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

Scores

CVSS	Score	Vector	Source
3.1	2.9 Low	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	mitre

Weaknesses

CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

Product	Versions
zlibzlib	before 1.3.2Affected

References

https://github.com/madler/zlib/issues/904
https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf
https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/
https://ostif.org/zlib-audit-complete/
https://github.com/madler/zlib/releases/tag/v1.3.2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.