[Git][security-tracker-team/security-tracker][master] CVE-2026-27171/zlib is not affecteing in bullseye

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4dfc4a14 by Tobias Frost at 2026-10-26T19:41:22+01:00
CVE-2026-27171/zlib is not affecteing in bullseye

The vulnerability affects newer zlib versions where x2nmodp()
processes negative lengths. Its loop

    while (n) {
        ...
        n >>= 1;
        ...
    }

does not terminate for negative n, since right-shifting a
negative value preserves the sign bit.

zlib 1.2.11 in bullseye does not use x2nmodp(). Also, its
crc32_combine_() implementation rejects negative lengths
before entering the processing loop.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -228424,9 +228424,10 @@ CVE-2026-27171 (zlib before 1.3.2 allows CPU consumption via crc32_combine64 and
 	- zlib 1:1.3.dfsg+really1.3.2-1 (bug #1128336)
 	[trixie] - zlib <no-dsa> (Minor issue)
 	[bookworm] - zlib <no-dsa> (Minor issue)
-	[bullseye] - zlib <postponed> (Minor issue; hardening of API)
+	[bullseye] - zlib <not-affected> (Affected code implemented later)
 	NOTE: https://github.com/madler/zlib/issues/904
 	NOTE: Fixed by: https://github.com/madler/zlib/commit/ba829a458576d1ff0f26fc7230c6de816d1f6a77 (v1.3.2)
+	NOTE: Introduced with https://github.com/madler/zlib/commit/f8719f5ae5acdc31d3794ddfea8ac963359de41e (v1.2.12)
 CVE-2026-27038
 	REJECTED
 CVE-2026-27037



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4dfc4a14182a8d2aeb9d9da8f13d76d30f99cfde

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4dfc4a14182a8d2aeb9d9da8f13d76d30f99cfde
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/471769d8/attachment.htm>