Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27171: A flaw was found in zlib. An attacker providing specially crafted input to the crc32_combine64 or crc32_combine_gen64 functions could trigger an infinite loop within the x2nmodp function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs22 | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-debuginfo | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-debugsource | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-devel | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-docs | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-full-i18n | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-libs | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-libs-debuginfo | 1:22.22.2-1.amzn2023.0.2 |
| Amazon Linux · 2023 | nodejs22-npm | 1:10.9.7-1.22.22.2.1.amzn2023.0.2 |
| Amazon Linux · 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.22.2.1.amzn2023.0.2 |
Vulnerabilities 1
-
Low 2.9
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shift…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-27171.html