Executive brief
A security vulnerability has been identified in the Ruby zlib library, which is used by applications to compress and decompress data. An attacker could provide specially crafted input that causes the application to crash or potentially allow for unauthorized access to data. This could lead to service outages or the exposure of sensitive information handled by the application.
Technical details
A classic buffer overflow (CWE-120) exists in the `zstream_buffer_ungets` function within `Zlib::GzipReader`. The vulnerability occurs because the function prepends caller-provided bytes to previously produced output without verifying that the underlying Ruby string buffer has sufficient capacity. When the buffer length exceeds its capacity during a `memmove` operation, memory corruption occurs. This can be triggered by providing large inputs to the `ungetc` method. The flaw allows for potential remote code execution or denial of service. Patches are available in versions 3.0.1, 3.1.2, and 3.2.3.
Affected products
- Ruby zlib < 3.0.1, >= 3.1.0, < 3.1.2, >= 3.2.0, < 3.2.3
Timeline
- 2026-03-05: disclosed: Initial publication by Ruby-lang
- 2026-04-16: advisory: GitHub and NVD advisory published
References
- https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w
- https://hackerone.com/reports/3467067
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/zlib/CVE-2026-27820.yml
- https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820
- https://api.github.com/repos/ruby/zlib/security-advisories/GHSA-g857-hhfv-j68w