Read the docs
TI-2026-22172 Aliases CVE-2026-27820GHSA-g857-hhfv-j68w

zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Priority LOW 16CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix Partial zlib (ruby): 3.0.1, 3.1.2, 3.2.3zlib (RubyGems): 3.2.3, 3.1.2, 3.0.1Red Hat: 8 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubyzlibbefore 3.0.1; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.33.0.1, 3.1.2, 3.2.3Patch availableCNA
—zlib (RubyGems)3.2.0 to before 3.2.33.2.3Patch availableGHSA-g857-hhfv-j68w
—zlib (RubyGems)3.1.0 to before 3.1.23.1.2Patch availableGHSA-g857-hhfv-j68w
—zlib (RubyGems)before 3.0.13.0.1Patch availableGHSA-g857-hhfv-j68w
  • zlib Vendorruby Affected before 3.0.1; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.3 Fixed in 3.0.1, 3.1.2, 3.2.3 Patch available CNA
  • zlib (RubyGems) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-g857-hhfv-j68w
  • zlib (RubyGems) Vendor— Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-g857-hhfv-j68w
  • zlib (RubyGems) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-g857-hhfv-j68w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*before 3.0.1; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.3Vulnerableruby
  • cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:* Versions before 3.0.1; 3.1.0 to before 3.1.2; 3.2.0 to before 3.2.3 Vulnerable ·ruby

Remediation

  • Fix · CNA zlib (ruby) Fixed in 3.0.1, 3.1.2, 3.2.3
  • Fix · GHSA-g857-hhfv-j68w zlib (RubyGems) Fixed in 3.2.3 Advisory →
  • Fix · GHSA-g857-hhfv-j68w zlib (RubyGems) Fixed in 3.1.2 Advisory →
  • Fix · GHSA-g857-hhfv-j68w zlib (RubyGems) Fixed in 3.0.1 Advisory →

Red Hat 8 advisories

  • RHSA-2026:50827 Released 2026-08-05 · Red Hat rating Important
    ruby:4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.aarch64::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.i686::ruby:4.0, ruby-4.0.6-34.module+el9.8.0+24564+e55418dc.ppc64le::ruby:4.0 +47
  • RHSA-2026:50828 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.aarch64::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.i686::ruby:3.3, ruby-3.3.12-8.module+el9.8.0+24568+2bbebe96.ppc64le::ruby:3.3 +47
  • RHSA-2026:50778 Released 2026-08-05 · Red Hat rating Important
    ruby security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.12-14.el10_2, ruby-bundled-gems-3.3.12-14.el10_2, ruby-default-gems-3.3.12-14.el10_2 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.12-14.el10_2
Show 5 more Red Hat advisories
  • RHSA-2026:50773 Released 2026-08-05 · Red Hat rating Important
    ruby4.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby4.0-4.0.6-36.el10_2, ruby4.0-devel-4.0.6-36.el10_2, ruby4.0-rubygem-mysql2-0.5.7-36.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby4.0-doc-4.0.6-36.el10_2
  • RHSA-2026:50728 Released 2026-08-05 · Red Hat rating Important
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.aarch64::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.i686::ruby:3.3, ruby-3.3.12-8.module+el8.10.0+24567+c4e5368e.ppc64le::ruby:3.3 +47
  • RHSA-2026:8838 Released 2026-04-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
  • RHSA-2026:7307 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
  • RHSA-2026:7305 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:50728
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:50827, RHSA-2026:50828
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:50773, RHSA-2026:50778
Red Hat Hardened ImagesFixed RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27820
  2. 2026-10-03 Alias added: GHSA-g857-hhfv-j68w
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences