CVE-2026-27820

{
  "id": "CVE-2026-27820",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-16T18:16:44.770",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3."
    },
    {
      "lang": "es",
      "value": "zlib es una interfaz Ruby para la biblioteca de compresión/descompresión zlib. Las versiones 3.0.0 e inferiores, 3.1.0, 3.1.1, 3.2.0 y 3.2.1 contienen una vulnerabilidad de desbordamiento de búfer en Zlib::GzipReader. La función zstream_buffer_ungets antepone bytes proporcionados por el llamador delante de la salida producida previamente, pero no garantiza que la cadena Ruby subyacente tenga suficiente capacidad antes de que memmove desplace los datos existentes. Esto puede llevar a corrupción de memoria cuando la longitud del búfer excede la capacidad. Este problema ha sido solucionado en las versiones 3.0.1, 3.1.2 y 3.2.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ruby",
          "product": "zlib",
          "versions": [
            {
              "version": "< 3.0.1",
              "status": "affected"
            },
            {
              "version": ">= 3.1.0, < 3.1.2",
              "status": "affected"
            },
            {
              "version": ">= 3.2.0, < 3.2.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 1.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "UNREPORTED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T18:20:13.051389Z",
          "id": "CVE-2026-27820",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        },
        {
          "lang": "en",
          "value": "CWE-131"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*",
              "versionEndExcluding": "3.0.1",
              "matchCriteriaId": "5DE8B341-809F-4E90-AA03-28B264F35B52"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "3.1.0",
              "versionEndExcluding": "3.1.2",
              "matchCriteriaId": "C9B291C1-492A-4684-BE65-36D10D28679F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:zlib:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "3.2.0",
              "versionEndExcluding": "3.2.3",
              "matchCriteriaId": "CD9F2E4A-7F44-43CD-8745-28BC10E5FA04"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://hackerone.com/reports/3467067",
      "source": "[email protected]",
      "tags": [
        "Permissions Required"
      ]
    }
  ]
}