Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27171: A flaw was found in zlib. An attacker providing specially crafted input to the crc32_combine64 or crc32_combine_gen64 functions could trigger an infinite loop within the x2nmodp function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs20 | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-debuginfo | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-debugsource | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-devel | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-docs | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-full-i18n | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-libs | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-libs-debuginfo | 1:20.20.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs20-npm | 1:10.8.2-1.20.20.2.1.amzn2023.0.2 |
| Amazon Linux · 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.20.2.1.amzn2023.0.2 |
Vulnerabilities 1
-
Low 2.9
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shift…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-27171.html