CVE-2026-27820
1 advisory.
RubyGems/zlib CVE-2026-27820: critical 9.8, EPSS 0.75%
Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
Action: Upgrade zlib to 3.0.1 or later.
bundle update zlibAffected
| introduced | fixed | last affected |
|---|---|---|
| 3.2.0 | 3.2.3 | - |
| 3.1.0 | 3.1.2 | - |
| 0 | 3.0.1 | - |
Fixed versions
| 3.2.3 | 3.1.2 | 3.0.1 |
Sources
- osv: GHSA-g857-hhfv-j68w
- https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w
- https://nvd.nist.gov/vuln/detail/CVE-2026-27820
- https://hackerone.com/reports/3467067
- https://github.com/ruby/zlib
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/zlib/CVE-2026-27820.yml
- https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820
CVE-2026-27820 · published · modified · JSON