zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
CVSS Details
- CVSS 3.1 Base Score: 2.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zlib | Mar 9, 2026 | Feb 18, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-npmUpgrade nodejs20Upgrade v8-11.3-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-libsUpgrade nodejs20-full-i18nUpgrade nodejs24-libsUpgrade nodejs20-docsUpgrade nodejs20-npmUpgrade nodejs24-docsUpgrade nodejs20-develUpgrade nodejs20-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-develUpgrade nodejs22-npmUpgrade nodejs24-develUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade nodejs22-docsUpgrade nodejs22-full-i18nUpgrade nodejs24-full-i18nUpgrade nodejs24-debugsourceUpgrade v8-12.4-develUpgrade nodejs20-libsUpgrade nodejs22 | May 4, 2026 | Feb 18, 2026 |
| Ibm Aix | — | Apply the fix or workaround for zlib_advisory3 | Jul 22, 2026 | Jul 22, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Feb 18, 2026 |
| Ubuntu | — | Upgrade lib32z1Upgrade libminizip-devUpgrade lib64z1-devUpgrade lib64z1Upgrade libminizip1t64Upgrade lib32z1-devUpgrade libx32z1Upgrade zlib1g-devUpgrade libx32z1-devUpgrade minizipUpgrade zlib1g | Aug 31, 2026 | Feb 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Feb 18, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub