zlib's crc32_combine can spin on a shift loop
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
- Advisory
- CVE-2026-27171
- Library
- zlib, zlib on Debian
- Published
- Severity
- 5.5 out of 10, as published
- Affected
- zlib before 1.3.2
- Fixed in
- 1.3.2
- Reaches you
- through another call
What triggers it
Calling crc32_combine64 or crc32_combine_gen64 with particular lengths.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
In the CRC-combining helpers, which inflating a PNG's or TIFF's data never calls; not reached by opening a file.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to zlib 1.3.2.
Specifically. Not a pre-decode matter: the flaw is in a call that opening a file never makes.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2026-27171
- The record entry, triaged 2026-11-03, last checked 2026-11-03