CVE-2026-27820: Buffer Overflow in Zlib Package's GzipReader Leading to Memory Corruption
Summary
CVE-2026-27820: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption. Affects zlib across 3 version ranges.
< 3.0.1
>= 3.1.0, < 3.1.2
>= 3.2.0, < 3.2.3
Fixed in 3.0.1, 3.1.2 or 3.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Zlib is a widely used software library for data compression. It provides functions for compressing and decompressing data streams, making it essential for various applications that require efficient data handling. The library is known for its speed and efficiency, but like any software, it can be vulnerable to security issues. This specific vulnerability affects the GzipReader component of the Zlib package, which is responsible for reading Gzip-compressed data.
Vulnerability Detail
A buffer overflow vulnerability exists in the Zlib::GzipReader due to improper handling of input data in the zstream_buffer_ungets function. This function is designed to prepend caller-provided bytes ahead of previously produced output. However, it fails to ensure that the backing Ruby string has sufficient capacity before executing a memmove operation to shift existing data. As a result, when the input buffer length exceeds its allocated capacity, it can lead to memory corruption, potentially allowing an attacker to exploit this flaw to execute arbitrary code or crash the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.13.0.1gem install zlib -v 3.0.1 -
>= 3.1.0, < 3.1.23.1.2gem install zlib -v 3.1.2 -
>= 3.2.0, < 3.2.33.2.3gem install zlib -v 3.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to limit the size of data being processed by the GzipReader, thereby mitigating the risk of buffer overflow until the package can be updated.
Conclusion
The buffer overflow vulnerability in the Zlib package's GzipReader poses significant risks, including memory corruption and potential exploitation. It is crucial for users to update to the patched versions of the zlib gem to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for zlib →
FAQ
CVE-2026-27820 is a vulnerability in the Zlib package that can lead to memory corruption due to a buffer overflow in the GzipReader component.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow an attacker to execute arbitrary code or crash the application, leading to potential data loss or unauthorized access.
The affected versions of the zlib gem are 3.2.2 and lower, as well as 3.1.0 and lower, and 0 and lower.
Yes, the CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for zlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
