CVE-2026-27820

Name	CVE-2026-27820
Description	zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby2.7 (PTS)	bullseye	2.7.4-1+deb11u1	vulnerable
	bullseye (security)	2.7.4-1+deb11u5	vulnerable
ruby3.1 (PTS)	bookworm, bookworm (security)	3.1.2-7+deb12u1	vulnerable
ruby3.3 (PTS)	forky, sid, trixie	3.3.8-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
ruby2.7	source	(unstable)	(unfixed)
ruby3.1	source	(unstable)	(unfixed)
ruby3.3	source	(unstable)	(unfixed)

Notes

https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w
Fixed by: https://github.com/ruby/zlib/commit/608d2be66fcbcb759cbe26c82e95f4381b8dd140 (v3.2.3)
Fixed by: https://github.com/ruby/zlib/commit/6cc139d87c498e60bcf38bc9e4f2ac0f2faa0eb1 (v3.1.2)
Fixed by: https://github.com/ruby/zlib/commit/82d5d26993e9b7eafc79bb1b6be9f39c5db964f9 (v3.0.1)