What’s Vulnerable › Vulnerabilities

CVE-2026-27171

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-18 · updated 2026-06-17
• Weakness: CWE-1284

Description

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

Affected products

• zlib: from 1.2.12 before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: zlib 1.3.2. Check the vendor advisory for mitigations.

References

• https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/
• https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf
• https://github.com/madler/zlib/issues/904
• https://github.com/madler/zlib/releases/tag/v1.3.2
• https://ostif.org/zlib-audit-complete/
• https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf

Get alerted when CVE-2026-27171 or the next vulnerability affects your stack