CVE-2026-27820 Details
Description
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
A buffer overflow vulnerability has been identified in the Zlib Ruby interface, specifically in the GzipReader component. This vulnerability affects Zlib versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0, and 3.2.1. The issue arises in the zstream_buffer_ungets function, which prepends caller-provided bytes before previously produced output. The function does not ensure that the backing Ruby string has sufficient capacity before the memmove operation shifts the existing data. As a result, memory corruption can occur when the buffer length exceeds its capacity.
Users are advised to update the Zlib gem to version 3.2.3 or later. For those using Ruby 3.2, update to Zlib 3.0.1; for Ruby 3.3, update to Zlib 3.1.2. The Zlib gem can be updated using the 'gem update zlib' command. If using Bundler, add 'gem "zlib", ">= 3.2.3"' to the Gemfile.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w | [email protected] | Vendor Advisory |
| https://hackerone.com/reports/3467067 | [email protected] | Permissions Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruby-lang zlib | < 3.0.1 >= 3.1.0, < 3.1.2 >= 3.2.0, < 3.2.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | [email protected] |