CVE catalog

CVE-2026-27820

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Mar 4, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.56% · Oct 25, 2026

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ruby3.1	bookworm	`3.1.2-7+deb12u1`	vulnerable
Debian	ruby3.1	bookworm-security	`3.1.2-7+deb12u1`	vulnerable
Cpe	ruby3.1	Not reported	Not reported	vulnerable
Cpe	zlib	Not reported	`3.0.1`	fixed
Cpe	zlib	Not reported	`3.1.2`	fixed
Cpe	zlib	Not reported	`3.2.3`	fixed
Alpine	ruby	3.23	`3.4.9-r0`	fixed
Alpine	ruby	3.24	`3.4.9-r0`	fixed
Ubuntu	ruby2.3	pro	`2.3.0-1`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.0-2`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.0-4ubuntu2`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.0-4ubuntu3`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.0-5ubuntu1`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.2`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.4`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.5`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.6`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.7`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.9`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.10`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.11`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~16.04.12`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.13`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.14`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.15`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm1`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm2`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm3`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm4`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm5`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm6`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm7`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm8`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm9`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm10`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm11`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm12`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm14`	vulnerable
Ubuntu	ruby2.3	pro	`2.3.1-2~ubuntu16.04.16+esm15`	fixed
Cpe	zlib	Not reported	`3.2.3`	fixed
Alpine	ruby	3.21	`3.3.13-r0`	fixed
Alpine	ruby	3.22	`3.4.9-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ruby3.1	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	zlib	cpe	Not reported	`3.0.1`	Not reported	Not reported	Not reported
Cpe	zlib	cpe	Not reported	`3.1.2`	Not reported	Not reported	Not reported
Cpe	zlib	cpe	Not reported	`3.2.3`	Not reported	Not reported	Not reported
Alpine	ruby	apk	3.23	`3.4.9-r0`	Not reported	ALPINE-CVE-2026-27820	Not reported
Alpine	ruby	apk	3.24	`3.4.9-r0`	Not reported	ALPINE-CVE-2026-27820	Not reported
Ubuntu	ruby2.3	deb	pro	`2.3.1-2~ubuntu16.04.16+esm15`	Not reported	USN-8556-1	Not reported
Cpe	zlib	cpe	Not reported	`3.2.3`	Not reported	NVD-CVE-2026-27820	Not reported
Alpine	ruby	apk	3.21	`3.3.13-r0`	Not reported	ALPINE-CVE-2026-27820	Not reported
Alpine	ruby	apk	3.22	`3.4.9-r0`	Not reported	ALPINE-CVE-2026-27820	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libruby3.1]Affected
Source package: [ruby3.1]
Details (4)
- 3.1.2-7+deb12u1 · amd64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
[ruby3.1]Affected
Details (4)
- 3.1.2-7+deb12u1 · amd64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
[ruby3.1-dev]Affected
Source package: [ruby3.1]
Details (4)
- 3.1.2-7+deb12u1 · amd64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · amd64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · arm64 · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
[ruby3.1-doc]Affected
Source package: [ruby3.1]
Details (4)
- 3.1.2-7+deb12u1 · all · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · all · bookworm
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · all · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12
- 3.1.2-7+deb12u1 · all · bookworm-security
  Affected
  nvd · ruby3.1 · debian · bookworm; nvd · ruby3.1 · debian · 12

[Debian 13 (Trixie)]

[libruby3.3]Affected
Source package: [ruby3.3]
Details (2)
- 3.3.8-2 · amd64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
- 3.3.8-2 · arm64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
[ruby3.3]Affected
Details (2)
- 3.3.8-2 · amd64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
- 3.3.8-2 · arm64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
[ruby3.3-dev]Affected
Source package: [ruby3.3]
Details (2)
- 3.3.8-2 · amd64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
- 3.3.8-2 · arm64 · trixie
  Affected
  nvd · ruby3.3 · debian · 13
[ruby3.3-doc]Affected
Source package: [ruby3.3]
Details (2)
- 3.3.8-2 · all · trixie
  Affected
  nvd · ruby3.3 · debian · 13
- 3.3.8-2 · all · trixie
  Affected
  nvd · ruby3.3 · debian · 13

Observed: Oct 27, 2026, 12:52:44 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]