GitStock

ruby/zlib · Security

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

GHSA ID
GHSA-g857-hhfv-j68w
CVE ID
CVE-2026-27820
Severity
medium
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4
5.9 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Description

Details

A buffer overflow vulnerability exists in Zlib::GzipReader.

The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.

Recommended action

We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.2 users: Update to zlib 3.0.1
  • For Ruby 3.3 users: Update to zlib 3.1.2

You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.

Affected versions

zlib gem 3.2.2 or lower

Credits

calysteon

References

CWEs

  • CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

References

Open GitHub