CVE Intelligence
Analysis AI-assisted

CVE-2026-27820: Ruby zlib gem: buffer overflow in GzipReader ungetc

The Ruby zlib gem contains a buffer overflow in Zlib::GzipReader that can corrupt memory when caller-provided data exceeds the capacity of the backing string. NVD scores the issue 9.8 under CVSS 3.1, and the record lists fixed versions 3.0.1, 3.1.2 and 3.2.3. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The zlib gem is the Ruby interface to the zlib compression library. According to the GitHub advisory cited in the record, the function zstream_buffer_ungets in Zlib::GzipReader can shift existing data with memmove before confirming that the backing Ruby string has enough capacity. The weakness is classified as CWE-120 (Classic Buffer Overflow).

Impact

  • The record describes possible memory corruption when the buffer length exceeds the available capacity.
  • NVD scores the issue 9.8 (critical) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector indicates network reachability, no privileges and no user interaction required, with high confidentiality, integrity and availability impact.
  • GitHub as CNA lists a score of 1.7 under CVSS 4.0, which differs substantially from the NVD assessment. Both values are reported in the record.

Affected products and versions

  • Ruby zlib gem: before 3.0.1; from 3.1.0 up to before 3.1.2; from 3.2.0 up to before 3.2.3.
  • The advisory description names 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 as affected releases.
  • The record also lists the product as Ruby-lang Zlib with equivalent ranges.

Exploitation status

  • CISA KEV does not list this CVE, so no confirmed active exploitation can be stated from the record.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC data in the record marks exploitation as none and automatable as yes, which is an assessment input rather than evidence of attacks.
  • The EPSS entry gives a probability of 0.00752 and a percentile of 0.54534, but its date (2026-10-23) is later than the publication date, so it should be treated with caution.

Remediation and mitigation

  • Upgrade the zlib gem to 3.0.1 for the first branch, 3.1.2 for the 3.1 line, or 3.2.3 for the 3.2 line, as stated in the advisory description.
  • The record's fixes field is empty, so confirm the fixed release against the GitHub advisory and your lockfile rather than relying on the field.
  • Where an immediate upgrade is not possible, reduce exposure by limiting the processing of gzip streams from untrusted sources and by isolating services that handle them.
  • Rebuild and redeploy applications after updating, so the new version is actually loaded.

Detection guidance

  • Inventory Ruby projects and check Gemfile.lock files and deployed bundles for the zlib gem and its version.
  • Use software composition analysis tools that map the gem to the advisory, and review container images and vendored dependencies as well.
  • Monitor for unexpected crashes or memory-related errors in Ruby processes that decompress gzip data from external sources, and correlate them with recent deployments.

Limitations of the available information

  • The record does not include proof-of-concept details, and the HackerOne report it cites requires permissions to view.
  • The fixes field is empty, so fixed versions are taken from the description text only.
  • The NVD and GitHub CVSS scores differ widely, and the record does not explain the difference.
  • The EPSS date is inconsistent with the publication date.

Frequently asked questions

What is the CVE-2026-27820 vulnerability?

It is a buffer overflow in the Ruby zlib gem's Zlib::GzipReader, in the zstream_buffer_ungets function, which can corrupt memory when the buffer length exceeds the backing string capacity.

Which versions are fixed?

The advisory description says the issue is fixed in versions 3.0.1, 3.1.2 and 3.2.3. The record's fixes field is empty, so check the GitHub advisory to confirm.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.