AIKIDO-2026-10288
zlib is vulnerable to Buffer Overflow
80
High Risk
This Affects:
zlibTL;DR
Affected versions of the zlib gem are vulnerable to a buffer overflow in Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes to an existing output buffer but does not ensure that the underlying Ruby string has sufficient capacity before shifting existing data with memmove. This can lead to a buffer overflow and memory corruption when the buffer length exceeds its allocated capacity.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
zlib is vulnerable to Buffer Overflow in versions 0.0.1 - 3.0.0, 3.1.0 - 3.1.1 and 3.2.0 - 3.2.2.
How to fix this
Upgrade the zlib library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant