5.5

CVE-2026-27171: zlib

CVSS: 5.5v3.1MediumAnalyzed
AliasesALPINE-CVE-2026-27171MGASA-2026-0076SUSE-SU-2026:0783-1
Published 18-02-2026Last modified 18-02-2026
Open JSON

Vulnerability summary

CVE-2026-27171 is a medium (CVSS 5.5) vulnerability in zlib. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.21%
0%100%
Low · -0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 6
OPENSUSE-SU-2026:20487-1SUSE-SU-2026:20659-1SUSE-SU-2026:20709-1SUSE-SU-2026:21013-1SUSE-SU-2026:21151-1CGA-624V-J5JQ-2HPH

Timeline

  1. 18-02-2026
    PublishedVulnerability first disclosed.
  2. 18-02-2026
    Last modifiedVulnerability information updated.

Description

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

-0.02 pp

From 0.23% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Zlib

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Opensuse3 products
  • freetype2&distro=openSUSE Tumbleweed< 2.15.0-1.1
  • zlib&distro=openSUSE Leap 15.6< 1.2.13-150500.4.6.1
  • zlib&distro=openSUSE Tumbleweed< 1.3.1-2.1
Suse3 products
  • zlib&distro=SUSE Linux Enterprise Micro 5.5< 1.2.13-150500.4.6.1
  • zlib&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 1.2.13-150500.4.6.1
  • zlib&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7< 1.2.13-150500.4.6.1
Chainguard2 products
  • zlib< 1.3.2-r0
  • zlib-dev< 1.3.2-r0
Wolfi2 products
  • zlib< 1.3.2-r0
  • zlib-dev< 1.3.2-r0
Alpine1 product
  • zlib≥ 1.2.12, < 1.3.2-r0
Debian1 product
  • zlibAll versions (No fix recorded) | < 1:1.3.dfsg+really1.3.2-1
Mageia1 product
  • zlib< 1.2.13-1.4.mga9
Ubuntu1 product
  • zlibAll versions (No fix recorded) | < 1:1.3.dfsg-3.1ubuntu2.2 | < 1:1.3.dfsg+really1.3.1-1ubuntu3.1
Zlib1 product
  • zlib< 1.3.2 | ≥ 1.2.12, < 1.3.2

9 vendors · 15 products

References

18 links
Show all 18 references