CVE-2026-27171

zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions

Loading…

Severity

Low

Red Hat Product Security

3.3

CVSS 3.1

Review impact separately from score.

Published · February 18, 2026

Updated · November 2, 2026

Description

A flaw was found in zlib. An attacker providing specially crafted input to the crc32_combine64 or crc32_combine_gen64 functions could trigger an infinite loop within the x2nmodp function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system.

Statement

This vulnerability is rated as Low. The primary impact is excessive CPU consumption, which can result in a denial of service (DoS) if the zlib process is not terminated and the infinite loop is allowed to run.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 3.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-835 · Loop with Unreachable Exit Condition