Summary
It was discovered that zlib incorrectly handled negative length parameters
in CRC32 combine functions. An attacker could use this issue to cause a denial
of service via excessive CPU consumption.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | zlib | 1:1.3.dfsg-3.1ubuntu2.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | zlib | 1:1.3.dfsg+really1.3.1-1ubuntu3.1 |
Vulnerabilities 1
-
Low 2.9
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shift…
References
-
report
https://ubuntu.com/security/CVE-2026-27171