zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
CVSS Details
- CVSS 4.0 Base Score: 1.7 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 17, 2026 | Apr 16, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.4-develUpgrade ruby3.4-rubygem-rakeUpgrade ruby3.4-rubygems-develUpgrade ruby3.4-rubygem-rbs-debuginfoUpgrade ruby3.4-rubygem-typeprofUpgrade ruby3.4-rubygem-rdocUpgrade ruby3.4-default-gemsUpgrade ruby3.4-rubygem-bigdecimalUpgrade ruby3.4-libsUpgrade ruby3.4-rubygem-io-console-debuginfoUpgrade ruby3.4Upgrade ruby3.4-bundled-gemsUpgrade ruby3.4-rubygem-bundlerUpgrade ruby3.4-rubygem-rssUpgrade ruby3.4-rubygem-irbUpgrade ruby3.4-debugsourceUpgrade ruby3.4-rubygem-psych-debuginfoUpgrade ruby3.4-rubygem-raccUpgrade ruby3.4-rubygemsUpgrade ruby3.4-rubygem-racc-debuginfoUpgrade ruby3.4-debuginfoUpgrade ruby3.4-libs-debuginfoUpgrade ruby3.4-bundled-gems-debuginfoUpgrade ruby3.4-rubygem-rexmlUpgrade ruby3.4-rubygem-io-consoleUpgrade ruby3.4-docUpgrade ruby3.4-rubygem-power_assertUpgrade ruby3.4-rubygem-jsonUpgrade ruby3.4-rubygem-json-debuginfoUpgrade ruby3.4-rubygem-rbsUpgrade ruby3.4-rubygem-test-unitUpgrade ruby3.4-rubygem-minitestUpgrade ruby3.4-rubygem-bigdecimal-debuginfoUpgrade ruby3.4-rubygem-psych | Jun 9, 2026 | Apr 16, 2026 |
| Debian | — | Upgrade ruby2.7 | Aug 5, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade rubygem-rexmlUpgrade ruby4.0-rubygem-pgUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade ruby4.0Upgrade ruby4.0-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-typeprofUpgrade rubygem-rakeUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubyUpgrade rubygem-abrtUpgrade ruby4.0-develUpgrade rubygemsUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-power_assertUpgrade ruby4.0-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-rssUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade ruby-libsNo solution existsUpgrade rubygem-irb | Jul 17, 2026 | Apr 16, 2026 |
| Rocky_linux | — | Upgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0Upgrade rubygem-mysql2-debugsourceUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-debuginfoUpgrade rubygem-raccUpgrade ruby4.0-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubyUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby4.0-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-rbs | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro) | Jul 20, 2026 | Jul 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub