CVE-2026-27171.toml

# zlib CRC32 combine: infinite loop on crafted inputs.
# 5-Spot does not call zlib: no flate2, libz-sys, miniz_oxide, or other
# compression crate appears in Cargo.lock, and the controller performs no
# gzip/zip/deflate processing. libz is only present as a transitive
# dependency of other packages shipped in the Distroless base; nothing in
# the 5-Spot binary invokes it.
cve = "CVE-2026-27171"
status = "not_affected"
justification = "vulnerable_code_not_in_execute_path"
impact_statement = "The 5-Spot controller binary has no link-time or runtime dependency on zlib; the vulnerable crc32_combine code path is never executed."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"