CVE-Katalog

CVE-2026-27171

zlib vulnerability

Schweregrad: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Feb 17, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.21% · Oct 22, 2026

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	zlib	sid	`1:1.3.dfsg+really1.3.2-3`	fixed
Debian	zlib	forky	`1:1.3.dfsg+really1.3.2-3`	fixed
Debian	zlib	trixie	`1:1.3.dfsg+really1.3.1-1`	vulnerable
Debian	zlib	bookworm	`1:1.2.13.dfsg-1`	vulnerable
Ubuntu	zlib	noble	Not reported	vulnerable
Ubuntu	zlib	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	lib32z1	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	lib32z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	lib64z1	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	lib64z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	libminizip-dev	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	libminizip1t64	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	libx32z1	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	libx32z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	minizip	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	zlib1g	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	zlib1g-dev	noble	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Alpine	zlib	3.20	`1.3.2-r0`	fixed
Alpine	zlib	3.21	`1.3.2-r0`	fixed
Alpine	zlib	3.22	`1.3.2-r0`	fixed
Alpine	zlib	3.23	`1.3.2-r0`	fixed
Alpine	zlib	3.24	`1.3.2-r0`	fixed
Ubuntu	zlib	24.04	`1:1.2.13.dfsg-1ubuntu5`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu2`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3.1`	fixed
Ubuntu	zlib	24.04	`1:1.2.13.dfsg-1ubuntu5`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.2`	fixed
Ubuntu	zlib	25.10	`1:1.3.dfsg+really1.3.1-1ubuntu1`	vulnerable
Ubuntu	zlib	25.10	`1:1.3.dfsg+really1.3.1-1ubuntu2`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu2`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3.1`	fixed
Opensuse	zlib	tumbleweed	`1.3.1-2.1`	fixed
Suse	zlib	linux enterprise micro 5.5	`1.2.13-150500.4.6.1`	fixed
Suse	zlib	linux enterprise module for basesystem 15 sp7	`1.2.13-150500.4.6.1`	fixed
Suse	zlib	linux enterprise module for development tools 15 sp7	`1.2.13-150500.4.6.1`	fixed
Opensuse	zlib	leap 15.6	`1.2.13-150500.4.6.1`	fixed
Opensuse	freetype2	tumbleweed	`2.15.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	zlib	source	sid	`1:1.3.dfsg+really1.3.2-1`	not yet assigned	Not reported	[1128336]
Debian	zlib	source	forky	`1:1.3.dfsg+really1.3.2-1`	not yet assigned	Not reported	[1128336]
Debian	zlib	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1128336]
Debian	zlib	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1128336]
Ubuntu	zlib	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	lib32z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	lib32z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	lib64z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	lib64z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	libminizip-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	libminizip1t64	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	libx32z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	libx32z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	minizip	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	zlib1g	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Ubuntu	zlib1g-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	Not reported	Not reported
Alpine	zlib	apk	3.20	`1.3.2-r0`	Not reported	ALPINE-CVE-2026-27171	Not reported
Alpine	zlib	apk	3.21	`1.3.2-r0`	Not reported	ALPINE-CVE-2026-27171	Not reported
Alpine	zlib	apk	3.22	`1.3.2-r0`	Not reported	ALPINE-CVE-2026-27171	Not reported
Alpine	zlib	apk	3.23	`1.3.2-r0`	Not reported	ALPINE-CVE-2026-27171	Not reported
Alpine	zlib	apk	3.24	`1.3.2-r0`	Not reported	ALPINE-CVE-2026-27171	Not reported
Ubuntu	zlib	deb	24.04	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	USN-8706-1	Not reported
Ubuntu	zlib	deb	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3.1`	Not reported	USN-8706-1	Not reported
Ubuntu	zlib	deb	24.04	`1:1.3.dfsg-3.1ubuntu2.2`	Not reported	UBUNTU-CVE-2026-27171	Not reported
Ubuntu	zlib	deb	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3.1`	Not reported	UBUNTU-CVE-2026-27171	Not reported
Opensuse	zlib	rpm	tumbleweed	`1.3.1-2.1`	Not reported	OPENSUSE-SU-2026:10617-1	Not reported
Suse	zlib	rpm	linux enterprise micro 5.5	`1.2.13-150500.4.6.1`	Not reported	SUSE-SU-2026:0783-1	Not reported
Suse	zlib	rpm	linux enterprise module for basesystem 15 sp7	`1.2.13-150500.4.6.1`	Not reported	SUSE-SU-2026:0783-1	Not reported
Suse	zlib	rpm	linux enterprise module for development tools 15 sp7	`1.2.13-150500.4.6.1`	Not reported	SUSE-SU-2026:0783-1	Not reported
Opensuse	zlib	rpm	leap 15.6	`1.2.13-150500.4.6.1`	Not reported	SUSE-SU-2026:0783-1	Not reported
Opensuse	freetype2	rpm	tumbleweed	`2.15.0-1.1`	Not reported	OPENSUSE-SU-2026:12179-1	Not reported

[Debian bug #1128336]

Notes

[trixie] zlib: Minor issue [bookworm] zlib: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lib32z1]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12
[lib32z1-dev]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12
[zlib1g]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12
- 1:1.2.13.dfsg-1 · arm64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12
[zlib1g-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12
- 1:1.2.13.dfsg-1 · arm64 · bookworm
  Betroffen
  usn · zlib · debian · bookworm; usn · zlib · debian · 12

[Debian 13 (Trixie)]

[lib32z1]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
[lib32z1-dev]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
[libminizip1t64]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  usn · zlib · debian · 13
[libminizip-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  usn · zlib · debian · 13
[minizip]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  usn · zlib · debian · 13
[zlib1g]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  usn · zlib · debian · 13
[zlib1g-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  usn · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  usn · zlib · debian · 13

[openSUSE Tumbleweed]

[freetype2-devel]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · x86_64 · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[freetype2-devel-32bit]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · x86_64 · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[freetype2-profile-tti35]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · noarch · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[ftdump]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · x86_64 · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[libfreetype6]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · x86_64 · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[libfreetype6-32bit]Unbekannt
Quellpaket: [freetype2]
Details (1)
- 2.14.3-1.2 · x86_64 · tumbleweed
  Unbekannt · Behoben: 2.15.0-1.1
  Version impact unknown
  usn · freetype2 · opensuse · tumbleweed
[libminizip1]Unbekannt
Quellpaket: [zlib]
Details (1)
- 1.3.1-3.3 · x86_64 · tumbleweed
  Unbekannt · Behoben: 1.3.1-2.1
  Version impact unknown
  usn · zlib · opensuse · tumbleweed
[libminizip1-32bit]Unbekannt
Quellpaket: [zlib]
Details (1)
- 1.3.1-3.3 · x86_64 · tumbleweed
  Unbekannt · Behoben: 1.3.1-2.1
  Version impact unknown
  usn · zlib · opensuse · tumbleweed
[libminizip1-x86-64-v3]Unbekannt
Quellpaket: [zlib]
Details (1)
- 1.3.1-3.3 · x86_64 · tumbleweed
  Unbekannt · Behoben: 1.3.1-2.1
  Version impact unknown
  usn · zlib · opensuse · tumbleweed

Weitere Ergebnisse

Beobachtet: Oct 24, 2026, 12:41:55 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]