Loading vulnerability…
zlib CRC32 Combine Infinite-Loop Denial of Service
CVE-2026-27171 is a denial-of-service vulnerability in zlib before version 1.3.2. Incorrect handling of negative length parameters in crc32_combine64 and crc32_combine_gen64 can cause the internal x2nmodp function to enter a non-terminating right-shift loop. Applications that pass attacker-controlled negative lengths to these functions can experience excessive CPU consumption. Vulnerable bundled copies of zlib can also expose dependent products.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can monopolize CPU resources and stall affected application processing, causing denial of service. The vulnerability has a high availability impact, with no identified confidentiality or integrity impact. Ubuntu and Huawei EulerOS assessments assign CVSS v3.0 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
If you can’t patch tonight, do this now.
Until patched, reject negative length parameters before invoking the affected CRC32 combine functions, and restrict attacker-controlled inputs that can reach these routines. Apply CPU resource limits and execution timeouts to affected processes to reduce denial-of-service impact.
Patch, then assume compromise.
Upgrade zlib to version 1.3.2 or later, or install vendor packages containing a backported fix. For Ubuntu 26.04 LTS, update to 1:1.3.dfsg+really1.3.1-1ubuntu3.1; for Ubuntu 24.04 LTS, update to 1:1.3.dfsg-3.1ubuntu2.2. Update bundled copies as well: FreeType 2.15.0 incorporates the fix, and Compress::Raw::Zlib 2.220 or later includes fixed zlib. Rebuild or update applications that statically embed vulnerable zlib code.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.