Resource Exhaustion Vulnerability in zlib Affected by Vendor Issue

CVE-2026-27171

What is CVE-2026-27171?

The zlib library before version 1.3.2 is susceptible to a resource exhaustion vulnerability that can lead to excessive CPU consumption. This issue arises from the functions crc32_combine64 and crc32_combine_gen64, where the x2nmodp operation can be exploited to perform right shifts within an unbounded loop, resulting in significant performance degradation. Failure to terminate the loop correctly can cause denial-of-service conditions, impacting the overall performance of systems utilizing the affected library versions.

References