1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27820

CVE-2026-27820: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Details

A buffer overflow vulnerability exists in Zlib::GzipReader.

The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.

Recommended action

We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

For Ruby 3.2 users: Update to zlib 3.0.1
For Ruby 3.3 users: Update to zlib 3.1.2

You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.

Affected versions

zlib gem 3.2.2 or lower

Credits

calysteon

References

https://hackerone.com/reports/3467067

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27820

CVE-2026-27820:

1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
zlib	rubygems	>= 3.2.0, < 3.2.3	3.2.3
zlib	rubygems	>= 3.1.0, < 3.1.2	3.1.2
zlib	rubygems	< 3.0.1	3.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the zlib Ruby gem, specifically in the C extension code. The analysis started by identifying the patched versions from the vulnerability description. By comparing the git tags of the vulnerable version v3.2.2 and the patched version v3.2.3 for the ruby/zlib repository, the commit that fixes the vulnerability was identified as 608d2be66fcbcb759cbe26c82e95f4381b8dd140.

The commit message "Fix buffer overflow at ungetc" points directly to the nature of the fix. Analysis of the patch in ext/zlib/zlib.c reveals the vulnerability lies within the zstream_buffer_ungets function. The vulnerable code performed a conditional buffer expansion that was insufficient, creating a buffer overflow condition when memmove was subsequently called. The fix removes this faulty condition and ensures the buffer is always expanded, thus preventing the overflow. The user-facing Ruby method that triggers this vulnerable C function is Zlib::GzipReader#ungetc, as demonstrated by the added test case in the patch.

Vulnerable functions

zstream_buffer_ungets

ext/zlib/zlib.c

The function `zstream_buffer_ungets` in `ext/zlib/zlib.c` is vulnerable to a buffer overflow. The original code had an insufficient check for buffer capacity before calling `memmove`. An attacker could provide a large input to the `ungetc` method of `Zlib::GzipReader`, causing `memmove` to write past the buffer's boundary, leading to memory corruption. The patch fixes this by unconditionally expanding the buffer before the `memmove` call.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.