CVE-2026-27820: ruby-lang zlib Classic Buffer Overflow
Vulnerability summary
CVE-2026-27820 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in ruby-lang zlib. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 4Timeline
- 16-04-2026PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UDiffers
- OSV · RubygemsEcosystem advisory · calculated8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST1.7LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.19 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Affected systems
Ubuntu7 products
- jrubyAll versions (No fix recorded)
- ruby2.3< 2.3.1-2~ubuntu16.04.16+esm15
- ruby2.5All versions (No fix recorded)
- ruby2.7All versions (No fix recorded)
- ruby3.0All versions (No fix recorded)
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3All versions (No fix recorded)
Alpine1 product
- ruby< 3.4.9-r0
Chainguard1 product
- truffleruby< 34.0.1-r0
Ruby1 product
- zlib< 3.0.1 | ≥ 3.1.0, < 3.1.2 | ≥ 3.2.0, < 3.2.3
Ruby-lang1 product
- zlib< 3.0.1 | ≥ 3.1.0, < 3.1.2 | ≥ 3.2.0, < 3.2.3
RubyGems1 product
- zlib≥ 3.2.0, < 3.2.3 | ≥ 3.1.0, < 3.1.2 | < 3.0.1
7 vendors · 14 products
References
12 links- github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68wX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/ruby/zlibPACKAGE