zlib before version 1.3.2 contains an infinite loop in the crc32_combine64 and crc32_combine_gen64 functions due to the x2nmodp routine performing right shifts inside a loop that never terminates. This flaw consumes excessive CPU time and can cause the process that invokes these functions to hang, resulting in a denial of service. The vulnerability is a local request for service interruption rather than remote code execution.

The affected product is the zlib compression library, supplied by the zlib project. All releases prior to zlib 1.3.2 are vulnerable. Systems that statically or dynamically link against these older zlib versions are impacted.

The CVSS score is 2.9, reflecting low severity. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Direct exploitation requires an attacker to supply specially crafted data that triggers the infinite loop, suggesting the attack vector is likely local or via a trusted application that processes untrusted input. The low severity and exploitation probability mean the risk is modest, but in environments relying on high availability, the DoS possibility is still operationally significant.