EUVD-2026-23278
GHSA-g857-hhfv-j68w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via gzip input (AV:N), but heap-state precondition required for overflow (AC:H); no auth needed (PR:N); impact limited to availability (A:L) per all scoring sources.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
AnalysisAI
Buffer overflow in the Ruby zlib gem's Zlib::GzipReader allows remote or local attackers supplying crafted gzip data to corrupt process memory via the zstream_buffer_ungets function. Affected versions span all 3.0.x releases through 3.0.0, the 3.1.0-3.1.1 range, and 3.2.0-3.2.1, collectively covering a wide install base across Ruby 3.2 and 3.3 runtime environments. The vulnerability carries an EPSS of 0.04% (13th percentile) and is not listed in CISA KEV, indicating low current exploitation probability despite the memory-corruption class of the flaw.
Technical ContextAI
The Ruby zlib gem (rubygems/zlib, CPE cpe:2.3:a:ruby:zlib:*:*:*:*:*:*:*:*) wraps the native zlib C library to expose gzip read/write functionality to Ruby programs. The root cause is CWE-120 (Buffer Copy without Checking Size of Input): the C-level zstream_buffer_ungets function prepends caller-supplied bytes ahead of previously buffered output by using memmove to shift existing data rightward in the backing Ruby String object. It performs this memmove without first verifying that the String's allocated capacity can accommodate the additional bytes. When the combined length of prepended plus existing data exceeds capacity, the memmove writes out-of-bounds, corrupting adjacent heap memory. The defect is triggered through GzipReader#ungetc or related unget paths that invoke zstream_buffer_ungets with attacker-influenced input lengths.
RemediationAI
The primary fix is to upgrade the zlib gem to a patched release: Ruby 3.2 users should upgrade to zlib 3.0.1; Ruby 3.3 users should upgrade to zlib 3.1.2; Ruby 3.4 and later users should upgrade to zlib 3.2.3 or higher. Running gem update zlib will pull the latest compatible release. For Bundler-managed projects, add gem "zlib", ">= 3.2.3" (or the appropriate minimum for the series in use) to the Gemfile and run bundle update zlib. Ubuntu users on affected LTS releases should apply the packages from USN-8556-1. If an immediate upgrade is not feasible, the most effective compensating control is to ensure that application code does not call GzipReader#ungetc or equivalent unget paths with externally controlled input lengths, effectively removing the trigger path at the application layer - though this may break legitimate decompression workflows. No generic workaround eliminates the underlying unsafe memmove in the gem itself.
Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated
Use-after-free in Ruby 4.x (before 4.0.5) lets remote attackers who can manipulate DNS response timing crash application
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today