Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M
CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
Low 1.7
In plain English
A low-severity buffer overflow in zlib from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)1.7Low
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | ruby | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-bundled-gems | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-bundled-gems | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-bundled-gems | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby-bundled-gems | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-default-gems | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-default-gems | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-default-gems | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby-default-gems | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-devel | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-devel | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-devel | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-devel | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby-doc | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-doc | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-doc | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-doc | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby-libs | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-libs | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-libs | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-libs | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby4.0 | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-devel | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-doc | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-rubygem-mysql2 | 0.5.7-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-rubygem-pg | 1.6.3-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:10 | rubygem-bigdecimal | 3.1.5-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.5-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.1.5-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-bigdecimal | 4.0.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-bundler | 2.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-bundler | 2.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-bundler | 2.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-bundler | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-io-console | 0.7.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-io-console | 0.7.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-io-console | 0.8.2-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-io-console | 0.7.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-irb | 1.13.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-irb | 1.13.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-irb | 1.13.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-irb | 1.16.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-json | 2.7.2-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-json | 2.7.2-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-json | 2.18.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-json | 2.7.2-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-minitest | 5.20.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-minitest | 5.20.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-minitest | 6.0.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-minitest | 5.20.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.7-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.7-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-pg | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-pg | 1.6.3-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-pg | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-pg-doc | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-pg-doc | 1.6.3-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-pg-doc | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-power_assert | 2.0.3-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.3-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-power_assert | 2.0.3-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-power_assert | 3.0.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-psych | 5.1.2-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-psych | 5.1.2-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-psych | 5.3.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-psych | 5.1.2-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-racc | 1.7.3-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-racc | 1.7.3-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-racc | 1.7.3-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-racc | 1.8.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rake | 13.1.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rake | 13.1.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rake | 13.3.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-rake | 13.1.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-rbs | 3.4.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rbs | 3.4.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rbs | 3.10.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-rbs | 3.4.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-rdoc | 6.6.3.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rdoc | 6.6.3.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rdoc | 6.6.3.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-rdoc | 7.0.4-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rexml | 3.4.4-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rexml | 3.4.4-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rexml | 3.4.4-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-rexml | 3.4.4-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rss | 0.3.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rss | 0.3.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rss | 0.3.2-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-rss | 0.3.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-test-unit | 3.6.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-test-unit | 3.6.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-test-unit | 3.6.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-test-unit | 3.7.5-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-typeprof | 0.21.9-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.9-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-typeprof | 0.21.9-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-typeprof | 0.31.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygems | 3.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygems | 3.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygems | 3.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygems | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygems-devel | 3.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygems-devel | 3.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygems-devel | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygems-devel | 3.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| Alpine:v3.21 | ruby | 3.3.13-r0 | ALPINE-CVE-2026-27820 |
| Alpine:v3.22 | ruby | 3.4.9-r0 | ALPINE-CVE-2026-27820 |
| Alpine:v3.23 | ruby | 3.4.9-r0 | ALPINE-CVE-2026-27820 |
| Alpine:v3.24 | ruby | 3.4.9-r0 | ALPINE-CVE-2026-27820 |
| Debian:12 | ruby3.1 | no fix listed | DEBIAN-CVE-2026-27820 |
| Debian:13 | ruby3.3 | no fix listed | DEBIAN-CVE-2026-27820 |
| Debian:14 | ruby3.3 | no fix listed | DEBIAN-CVE-2026-27820 |
| Rocky Linux:10 | ruby | 0:3.3.12-14.el10_2 | RLSA-2026:50778 |
| Rocky Linux:8 | ruby | 0:3.3.12-8.module+el8.10.0+40269+dc93e2d1 | RLSA-2026:50728 |
| Rocky Linux:9 | ruby | 0:4.0.6-34.module+el9.8.0+40271+b5850c84 | RLSA-2026:50827 |
| Rocky Linux:9 | ruby | 0:3.3.12-8.module+el9.8.0+40270+7a73441e | RLSA-2026:50828 |
| Rocky Linux:10 | ruby4.0 | 0:4.0.6-36.el10_2 | RLSA-2026:50773 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1820+f3fffb92 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1826+b62220b4 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.9.0+1537+0b2034bd | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:50828 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.7-1.module+el9.8.0+40094+ce01217c | RLSA-2026:50827 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:9 | rubygem-pg | 0:1.6.3-1.module+el9.8.0+40094+ce01217c | RLSA-2026:50827 |
| Rocky Linux:9 | rubygem-pg | 0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:50828 |
| RubyGems | zlib | 3.1.2 | GHSA-g857-hhfv-j68w |
| RubyGems | zlib | 3.2.3 | GHSA-g857-hhfv-j68w |
| RubyGems | zlib | 3.0.1 | GHSA-g857-hhfv-j68w |
| Ubuntu:25.10 | jruby | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:26.10 | jruby | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:22.04:LTS | ruby3.0 | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:24.04:LTS | ruby3.2 | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:25.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:26.04:LTS | ruby3.3 | no fix listed | UBUNTU-CVE-2026-27820 |
| Ubuntu:26.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2026-27820 |
Affected products (as reported)
Weakness: CWE-120, CWE-131 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
References
- https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w x_refsource_CONFIRM
- https://hackerone.com/reports/3467067 x_refsource_MISC