--- title: CVE-2026-27171 description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-27171 --- # CVE-2026-27171 Publication date 18 February 2026 Last updated 1 September 2026 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/CVE-2026-27171#priority-reason ) ## Cvss 3 Severity Score **2.9 · Low** [Score breakdown](https://ubuntu.com/security/CVE-2026-27171#impact-score) Toggle side navigation ## Description zlib before 1.3.2 allows CPU consumption via crc32\_combine64 and crc32\_combine\_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. [Read the notes from the security team](https://ubuntu.com/security/CVE-2026-27171#notes) ### Why is this CVE low priority? Resource consumption via API misuse only [Learn more about Ubuntu priority](https://ubuntu.com/security/cves/about#priority) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | zlib | 26.04 LTS resolute | Fixed 1:1.3.dfsg+really1.3.1-1ubuntu3.1 | | 25.10 questing | Ignored end of life, was needed | | 24.04 LTS noble | Fixed 1:1.3.dfsg-3.1ubuntu2.2 | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | rsync | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 24.04 LTS noble | Not affected | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | klibc | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 24.04 LTS noble | Not affected | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | | zsync | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 24.04 LTS noble | Not affected | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) since 3.2.0-1, rsync builds with the system zlib This issue stems from the misuse of an API, no indication that the API is being misused by anything in Ubuntu. This would only result in cpu consumption if it is in fact being misused. Marking this issue as low priority. --- ### [pfsmorigo](https://launchpad.net/~pfsmorigo) The vulnerable code was introduced in zlib 1.3.0. rsync from trusty to focal bundle zlib 1.2.8. klibc from trusty to resolute bundle zlib 1.2.3. zsync from trusty to resolute bundle zlib 1.2.1.1. ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 2.9 · Low * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Local | | Attack complexity | High | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | None | | Availability impact | Low | * Scores | Parameter | Value | | --- | --- | | Base score | 2.9 · Low | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27171) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-27171) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-27171) ### Related Ubuntu Security Notices (USN) + [USN-8706-1](https://usn.ubuntu.com/USN-8706-1) + zlib vulnerability + 31 August 2026 ### Other references * * * * *