Vulnerability Description
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
CVSS Score
2.9
LOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zlib | Zlib | >= 1.2.12, < 1.3.2 |
Related Weaknesses (CWE)
References
- https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/Product
- https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdfTechnical Description
- https://github.com/madler/zlib/issues/904ExploitIssue Tracking
- https://github.com/madler/zlib/releases/tag/v1.3.2Release Notes
- https://ostif.org/zlib-audit-complete/Product
- https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdfTechnical Description
FAQ
What is CVE-2026-27171?
CVE-2026-27171 is a vulnerability with a CVSS score of 2.9 (LOW). zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
How severe is CVE-2026-27171?
CVE-2026-27171 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27171?
Check the references section above for vendor advisories and patch information. Affected products include: Zlib Zlib.