Buffer overflow in Ruby Zlib
CVE-2026-27820
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Vulnerability class: Buffer Overflow
EPSS: 0.006 (43.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ruby Zlib — versions < 3.0.1, >= 3.1.0, < 3.1.2, >= 3.2.0, < 3.2.3
- Ruby-lang Zlib
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-27820?
- CVE-2026-27820 is a critical-severity vulnerability in Ruby Zlib, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.8/10. Published 2026-04-16.
- How severe is CVE-2026-27820?
- Critical severity. CVSS v3 base score is 9.8 out of 10.