Description
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zlib | zlib | < 1.3.2 | 1.3.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zlib | 1:1.3.dfsg+really1.3.2-1 | — |
| Debian 13 | zlib | 1:1.3.dfsg+really1.3.1-1+deb13u1 | — |
| Debian 12 | zlib | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | zlib | 1:1.3.dfsg+really1.3.1-1ubuntu3.1 | USN-8706-1 |
| Ubuntu 25.10 | zlib | No fix yet | — |
| Ubuntu 24.04 LTS | zlib | 1:1.3.dfsg-3.1ubuntu2.2 | USN-8706-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | zlib | 1.2.13-150500.4.6.1 | SUSE-SU-2026:0783-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | zlib | 1.2.13-160000.3.1 | SUSE-SU-2026:21151-1 |
| SLES 16.0 | zlib | 1.2.13-160000.3.1 | SUSE-SU-2026:21151-1 |
| SLE Micro 6.2 | zlib | 1.2.13-160000.3.1 | SUSE-SU-2026:21013-1 |
| SLE Micro 6.1 | zlib | 1.2.13-slfo.1.1_2.1 | SUSE-SU-2026:20659-1 |
| SLE Micro 6.0 | zlib | 1.2.13-7.1 | SUSE-SU-2026:20709-1 |
| SLE Micro 5.5 | zlib | 1.2.13-150500.4.6.1 | SUSE-SU-2026:0783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freetype2 | 2.15.0-1.1 | openSUSE-SU-2026:12179-1 |
| openSUSE Tumbleweed | zlib | 1.3.1-2.1 | openSUSE-SU-2026:10617-1 |
| openSUSE Leap 16.0 | zlib | 1.2.13-160000.3.1 | openSUSE-SU-2026:20487-1 |
| openSUSE Leap 15.6 | zlib | 1.2.13-150500.4.6.1 | SUSE-SU-2026:0783-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | zlib | 1.3.2-r0 | — |
| Alpine v3.23 | zlib | 1.3.2-r0 | — |
| Alpine v3.22 | zlib | 1.3.2-r0 | — |
| Alpine v3.21 | zlib | 1.3.2-r0 | — |
| Alpine v3.20 | zlib | 1.3.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs20 +4 | 1:20.20.2-1.amzn2023.0.2 | ALAS2023-2026-1608 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.8.2-1.20.20.2.1.amzn2023.0.2 | ALAS2023-2026-1608 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.22.2-1.amzn2023.0.2 | ALAS2023-2026-1616 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.7-1.22.22.2.1.amzn2023.0.2 | ALAS2023-2026-1616 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.15.0-1.amzn2023.0.1 | ALAS2023-2026-1609 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.12.1-1.24.15.0.1.amzn2023.0.1 | ALAS2023-2026-1609 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.20.2.1.amzn2023.0.2 | ALAS2023-2026-1608 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.amzn2023.0.2 | ALAS2023-2026-1616 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.15.0.1.amzn2023.0.1 | ALAS2023-2026-1609 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk +6 | No fix yet | — |
| Azure Linux 3 | kata-containers | 3.19.1.kata3-6 | — |
| Azure Linux 3 | zlib | 1.3.2-1 | — |
| Azure Linux 2 (CBL-Mariner) | fltk +7 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | zlib +1 | 1.3.2-r0 | — |
Advisories 15
- WID-SEC-2026-0435 zlib: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- openSUSE-SU-2026:12179-1 freetype2-devel-2.15.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 19, 2026
- USN-8706-1 zlib vulnerability Ubuntu Security Notices (USN) · Sep 9, 2026
- WID-SEC-2026-1032 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- ALAS2023-2026-1608 Low: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- ALAS2023-2026-1609 Moderate: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- ALAS2023-2026-1616 Low: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- openSUSE-SU-2026:10617-1 libminizip1-1.3.1-2.1 on GA media SUSE / openSUSE Security Updates · Apr 26, 2026
- openSUSE-SU-2026:20487-1 Security update for zlib SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21151-1 Security update for zlib SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21013-1 Security update for zlib SUSE / openSUSE Security Updates · Apr 14, 2026
- SUSE-SU-2026:20709-1 Security update for zlib SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20659-1 Security update for zlib SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0783-1 Security update for zlib SUSE / openSUSE Security Updates · Mar 4, 2026