Lucene search

K
cve[email protected]CVE-2024-27282
HistoryMay 14, 2024 - 3:11 p.m.

CVE-2024-27282

2024-05-1415:11:57
web.nvd.nist.gov
72
cve-2024-27282
ruby
regex compiler
vulnerability
fix
heap data
sensitive strings
nvd

6.5 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.