zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
CVSS Details
- CVSS 3.1 Base Score: 2.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zlib | Mar 9, 2026 | Feb 18, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-docsUpgrade nodejs20-debugsourceUpgrade nodejs22-libsUpgrade nodejs20-docsUpgrade nodejs20-npmUpgrade nodejs20Upgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade v8-11.3-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs20-develUpgrade nodejs22-develUpgrade nodejs24-libsUpgrade nodejs20-full-i18nUpgrade nodejs24-npmUpgrade nodejs22-debugsourceUpgrade nodejs22-npmUpgrade nodejs22Upgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs22-full-i18nUpgrade nodejs24-debugsourceUpgrade nodejs22-docsUpgrade nodejs20-libsUpgrade v8-12.4-develUpgrade nodejs24Upgrade nodejs22-debuginfo | May 4, 2026 | Feb 18, 2026 |
| Ibm Aix | — | Apply the fix or workaround for zlib_advisory3 | Jul 22, 2026 | Jul 22, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Feb 18, 2026 |
| Ubuntu | — | Upgrade lib32z1Upgrade lib64z1-devUpgrade libminizip-devUpgrade lib32z1-devUpgrade libminizip1t64Upgrade lib64z1Upgrade zlib1g-devUpgrade libx32z1-devUpgrade libx32z1Upgrade minizipUpgrade zlib1g | Aug 31, 2026 | Feb 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Feb 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub