Buffer overflow in Ruby Zlib
CVE-2026-27820
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (53.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.008 · change: +0.002
Affected products
- Ruby Zlib — versions < 3.0.1, >= 3.1.0, < 3.1.2, >= 3.2.0, < 3.2.3
- Ruby-Lang Zlib
Weakness classification (CWE)
References
- github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w (Vendor Advisory)
- hackerone.com/reports/3467067 (Permissions Required)
Frequently asked questions
- What is CVE-2026-27820?
- CVE-2026-27820 is a critical-severity vulnerability in Ruby Zlib, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.8/10. Published 2026-04-16.
- How severe is CVE-2026-27820?
- Critical severity. CVSS v3 base score is 9.8 out of 10.