[DRE-maint] Bug#1134341: ruby3.3: CVE-2026-27820

[Salvatore Bonaccorso]

Source: ruby3.3
Version: 3.3.8-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for ruby3.3.

CVE-2026-27820[0]:
| zlib is a Ruby interface for the zlib compression/decompression
| library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1
| contain a buffer overflow vulnerability in the Zlib::GzipReader. The
| zstream_buffer_ungets function prepends caller-provided bytes ahead
| of previously produced output but fails to guarantee the backing
| Ruby string has enough capacity before the memmove shifts the
| existing data. This can lead to memory corruption when the buffer
| length exceeds capacity. This issue has been fixed in versions
| 3.0.1, 3.1.2 and 3.2.3.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-27820
    https://www.cve.org/CVERecord?id=CVE-2026-27820
[1] https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore