CVE-2026-27171
Infinite Loop CPU Consumption in zlib crc32_combine Functions
Publication date: 2026-02-18
Last updated on: 2026-03-25
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zlib | zlib | From 1.2.12 (inc) to 1.3.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27171 is a vulnerability in the zlib compression library before version 1.3.2. It involves the functions crc32_combine64 and crc32_combine_gen64, where a specific internal function (x2nmodp) performs right shifts inside a loop that lacks a termination condition. This can cause the function to enter an infinite loop, leading to excessive CPU consumption.
Specifically, the vulnerability can be triggered when crc32_combine_gen64 is called with the value 0xffffffffffffffff, which can occur indirectly by passing an empty mode string to gzopen(), causing it to return NULL. Calling gzoffset64(NULL) then returns this problematic value, which when passed to crc32_combine_gen64 causes the infinite loop.
How can this vulnerability impact me? :
This vulnerability can lead to a denial of service condition by causing the affected zlib functions to enter an infinite loop, resulting in high CPU usage and potentially making the system or application unresponsive.
The CVSS v3.1 score of 2.9 (low severity) reflects that the attack vector requires local access with high attack complexity and no privileges, and it impacts availability only, without affecting confidentiality or integrity.
Therefore, the main impact is resource exhaustion (CPU consumption), which can degrade performance or availability of applications relying on zlib for compression.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability CVE-2026-27171 in zlib can be detected by testing for the infinite loop condition in the function crc32_combine_gen64 when it receives the argument 0xffffffffffffffff. This can occur indirectly by passing an empty mode string to gzopen(), which returns NULL, and then calling gzoffset64(NULL) to get the problematic value.
A proof-of-concept involves writing arbitrary input data to a file, opening it with gzopen() using an empty mode string, then calling gzoffset64() on the NULL pointer, and finally passing the returned value to crc32_combine_gen64() to observe the infinite loop.
To detect this on your system, you can run a test program or script that performs these steps and monitors CPU usage or hangs indicating the infinite loop.
- Write data to a file.
- Call gzopen() with an empty mode string to get a NULL pointer.
- Call gzoffset64() on the NULL pointer to get 0xffffffffffffffff.
- Pass this value to crc32_combine_gen64() and observe if the process enters an infinite loop or high CPU usage.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to update the zlib library to version 1.3.2 or later, which includes fixes addressing this vulnerability along with other security improvements.
Updating to the latest version ensures that the infinite loop issue in crc32_combine64 and other related security findings identified in the 7ASecurity audit are resolved.
Additionally, reviewing and hardening your build system and supply chain processes as recommended by the audit can further improve security.
- Upgrade zlib to version 1.3.2 or newer.
- Apply any relevant patches or updates from your operating system or software vendor.
- Avoid using unsafe legacy configurations or disabling C99 snprintf support, which can introduce other vulnerabilities.