🛡️ CVE-2026-27820 — zlib

🔴 CVSS 9.8 — Critical ✅ No Known Exploit NVD
9.8
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Details

A buffer overflow vulnerability exists in Zlib::GzipReader.

The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.

Recommended action

We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.2 users: Update to zlib 3.0.1
  • For Ruby 3.3 users: Update to zlib 3.1.2

You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.

Affected versions

zlib gem 3.2.2 or lower

Credits

[calysteon](https://hackerone.com/calysteon)

References

  • https://hackerone.com/reports/3467067

Affected software

CVE-2026-27820 is recorded against 2 packages.

  • unknown
  • zlib (fixed in 3.0.1)

Timeline and source

Published on 16 April 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
hackerone.com (Web)
github.com (Package)
github.com (Web)
www.ruby-lang.org (Web)

CVE-2026-27820 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Critical
CVSS Score 9.8
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2026-04-16
Updated 2026-08-12
Modified N/A
Fix URL N/A

Affected Packages

Software From version Fixed in
unknown — —
zlib — 3.0.1

Similar Threats

Exploit Protection

Are you running zlib?

CVE-2026-27820 carries CVSS 9.8 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2026-27820 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.