CVE-2026-27820: zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
Details
A buffer overflow vulnerability exists in Zlib::GzipReader.
The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.
Recommended action
We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
For Ruby 3.2 users: Update to zlib 3.0.1 For Ruby 3.3 users: Update to zlib 3.1.2
You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.
Affected versions
zlib gem 3.2.2 or lower
Credits
calysteon
References
https://hackerone.com/reports/3467067
Other sources
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
— NVD
zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27820?
CVE-2026-27820 has a high severity due to its potential for causing memory corruption through a buffer overflow.
How do I fix CVE-2026-27820?
To fix CVE-2026-27820, update zlib to version 3.2.2 or later as it addresses the buffer overflow vulnerability.
What versions of zlib are affected by CVE-2026-27820?
CVE-2026-27820 affects zlib versions 3.0.0 and below, and specifically versions 3.1.0, 3.1.1, 3.2.0, and 3.2.1.
What type of vulnerability is CVE-2026-27820?
CVE-2026-27820 is identified as a buffer overflow vulnerability in the Zlib::GzipReader.
Can CVE-2026-27820 be exploited remotely?
Yes, CVE-2026-27820 can potentially be exploited remotely if an attacker can send large input streams to an application using the affected zlib versions.