CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w	Vendor Advisory
https://hackerone.com/reports/3467067	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:zlib::::::ruby::*
	cpe:2.3:a:ruby-lang:zlib::::::ruby::*
	cpe:2.3:a:ruby-lang:zlib::::::ruby::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) zlib es una interfaz Ruby para la biblioteca de compresión/descompresión zlib. Las versiones 3.0.0 e inferiores, 3.1.0, 3.1.1, 3.2.0 y 3.2.1 contienen una vulnerabilidad de desbordamiento de búfer en Zlib::GzipReader. La función zstream_buffer_ungets antepone bytes proporcionados por el llamador delante de la salida producida previamente, pero no garantiza que la cadena Ruby subyacente tenga suficiente capacidad antes de que memmove desplace los datos existentes. Esto puede llevar a corrupción de memoria cuando la longitud del búfer excede la capacidad. Este problema ha sido solucionado en las versiones 3.0.1, 3.1.2 y 3.2.3.

Information

Published : 2026-04-16 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-27820

Mitre link : CVE-2026-27820

CVE.ORG link : CVE-2026-27820

JSON object : View

Products Affected

ruby-lang

zlib

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-131

Incorrect Calculation of Buffer Size

{"id": "CVE-2026-27820", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27820", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T18:20:13.051389Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "zlib", "versions": [{"status": "affected", "version": "< 3.0.1"}, {"status": "affected", "version": ">= 3.1.0, < 3.1.2"}, {"status": "affected", "version": ">= 3.2.0, < 3.2.3"}]}]}], "published": "2026-04-16T18:16:44.770", "references": [{"url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/3467067", "tags": ["Permissions Required"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-131"}]}], "descriptions": [{"lang": "en", "value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."}, {"lang": "es", "value": "zlib es una interfaz Ruby para la biblioteca de compresi\u00f3n/descompresi\u00f3n zlib. Las versiones 3.0.0 e inferiores, 3.1.0, 3.1.1, 3.2.0 y 3.2.1 contienen una vulnerabilidad de desbordamiento de b\u00fafer en Zlib::GzipReader. La funci\u00f3n zstream_buffer_ungets antepone bytes proporcionados por el llamador delante de la salida producida previamente, pero no garantiza que la cadena Ruby subyacente tenga suficiente capacidad antes de que memmove desplace los datos existentes. Esto puede llevar a corrupci\u00f3n de memoria cuando la longitud del b\u00fafer excede la capacidad. Este problema ha sido solucionado en las versiones 3.0.1, 3.1.2 y 3.2.3."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "5DE8B341-809F-4E90-AA03-28B264F35B52", "versionEndExcluding": "3.0.1"}, {"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "C9B291C1-492A-4684-BE65-36D10D28679F", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "CD9F2E4A-7F44-43CD-8745-28BC10E5FA04", "versionEndExcluding": "3.2.3", "versionStartIncluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}