CVE-2026-27820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27820", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:32:39.799Z", "datePublished": "2026-04-16T17:27:48.944Z", "dateUpdated": "2026-04-16T18:20:21.451Z"}, "containers": {"cna": {"title": "zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption", "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-131", "lang": "en", "description": "CWE-131: Incorrect Calculation of Buffer Size", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w"}, {"name": "https://hackerone.com/reports/3467067", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3467067"}], "affected": [{"vendor": "ruby", "product": "zlib", "versions": [{"version": "< 3.0.1", "status": "affected"}, {"version": ">= 3.1.0, < 3.1.2", "status": "affected"}, {"version": ">= 3.2.0, < 3.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T17:27:48.944Z"}, "descriptions": [{"lang": "en", "value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."}], "source": {"advisory": "GHSA-g857-hhfv-j68w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T18:20:13.051389Z", "id": "CVE-2026-27820", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T18:20:21.451Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T18:20:13.051389Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T18:20:15.404Z"}}], "cna": {"title": "zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption", "source": {"advisory": "GHSA-g857-hhfv-j68w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ruby", "product": "zlib", "versions": [{"status": "affected", "version": "< 3.0.1"}, {"status": "affected", "version": ">= 3.1.0, < 3.1.2"}, {"status": "affected", "version": ">= 3.2.0, < 3.2.3"}]}], "references": [{"url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w", "name": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://hackerone.com/reports/3467067", "name": "https://hackerone.com/reports/3467067", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131: Incorrect Calculation of Buffer Size"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T17:27:48.944Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27820", "state": "PUBLISHED", "dateUpdated": "2026-04-16T18:20:21.451Z", "dateReserved": "2026-02-24T02:32:39.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-16T17:27:48.944Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zlib", "vendor": "ruby", "versions": [{"status": "affected", "version": "< 3.0.1"}, {"status": "affected", "version": ">= 3.1.0, < 3.1.2"}, {"status": "affected", "version": ">= 3.2.0, < 3.2.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "5DE8B341-809F-4E90-AA03-28B264F35B52", "versionEndExcluding": "3.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "C9B291C1-492A-4684-BE65-36D10D28679F", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "CD9F2E4A-7F44-43CD-8745-28BC10E5FA04", "versionEndExcluding": "3.2.3", "versionStartIncluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."}, {"lang": "es", "value": "zlib es una interfaz Ruby para la biblioteca de compresi\u00f3n/descompresi\u00f3n zlib. Las versiones 3.0.0 e inferiores, 3.1.0, 3.1.1, 3.2.0 y 3.2.1 contienen una vulnerabilidad de desbordamiento de b\u00fafer en Zlib::GzipReader. La funci\u00f3n zstream_buffer_ungets antepone bytes proporcionados por el llamador delante de la salida producida previamente, pero no garantiza que la cadena Ruby subyacente tenga suficiente capacidad antes de que memmove desplace los datos existentes. Esto puede llevar a corrupci\u00f3n de memoria cuando la longitud del b\u00fafer excede la capacidad. Este problema ha sido solucionado en las versiones 3.0.1, 3.1.2 y 3.2.3."}], "id": "CVE-2026-27820", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27820", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T18:20:13.051389Z", "version": "2.0.3"}}]}, "published": "2026-04-16T18:16:44.770", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3467067"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-131"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader", "id": "2459002", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459002"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstream_buffer_ungets function does not ensure sufficient memory capacity before moving existing data, which can lead to memory corruption. An attacker could potentially exploit this to cause unexpected behavior or system instability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-27820", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "ruby4.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby4.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-04-16T17:27:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27820\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27820\nhttps://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w\nhttps://hackerone.com/reports/3467067"], "statement": "A buffer overflow vulnerability exists in the Zlib::GzipReader component of the Ruby zlib interface. This flaw, caused by insufficient memory capacity during data manipulation, could lead to memory corruption and system instability. This vulnerability is considered of a Moderate severity this happens because the high complexity to exploit, additionally the attacker may have not full control over the data is being corrupted or exfiltrated.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.0,3.1.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.0,3.2.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zlib", "source": "cna", "vendor": "ruby"}, "product": "zlib", "vendor": "ruby"}], "analysis": {"en": {"generated_at": "2026-04-17T04:52:16.557637+00:00", "value": {"mitigation_remediation": ["Upgrade the Ruby zlib library to version 3.0.1, 3.1.2, 3.2.3 or later.", "Avoid using Zlib::GzipReader.ungetc on data from untrusted sources.", "Validate input size and reject gzip streams exceeding a safe threshold before passing them to ungetc."], "summary": {"action": "Apply Patch", "impact": "Memory Corruption"}, "threat_synthesis": {"affected_systems": "Affected are Ruby zlib versions 3.0.0 and earlier, 3.1.0, 3.1.1, 3.2.0, and 3.2.1. The issue was fixed in version 3.0.1, 3.1.2, and 3.2.3. All Ruby applications that depend on zlib and invoke Zlib::GzipReader::ungetc with large streams are vulnerable.", "description_and_impact": "The flaw is a buffer overflow in Zlib::GzipReader\u2019s zstream_buffer_ungets function within the Ruby zlib library. The function prepends caller\u2011supplied bytes ahead of existing output but does not verify the backing Ruby string has adequate capacity before the memmove operation. When the combined input exceeds the capacity, memory corruption occurs. This type of vulnerability aligns with CWE\u2011120 and CWE\u2011131 and can result in arbitrary code execution or process crash if an attacker supplies a sufficiently large payload.", "risk_and_exploitability": "The CVSS score is 1.7, indicating low severity. Exploit probability is not available, and it is not recognized in the CISA known exploitation catalog. Based on the description, it is inferred that the likely attack vector involves supplying a large gzip payload to the Zlib::GzipReader::ungetc function, which could trigger the overflow. The risk is limited to applications that accept large gzip payloads but should still be mitigated promptly."}}}}, "created": "2026-04-17T05:00:05.503993+00:00", "updated": "2026-04-17T08:01:29.411318+00:00", "vendors": ["ruby", "ruby$PRODUCT$zlib"]}