CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

EUVD-2026-49151

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-64883

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Ruby bindings. This issue occurs during ZLIB decompression within the THeaderTransport...

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...

GHSA-XG2H-5XR2-29JW Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...

EUVD-2026-44926

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator...

GHSA-2X63-GW47-W4MM vulnerabilities

Vulnerabilities for packages: pghero, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, pghero-fips, gitlab-rails-ce-fips, ruby4.0-rails, gitlab-rails-ce...

Critical Photon OS Security Update - PHSA-2026-5.0-0929

Updates of 'libmicrohttpd', 'rubygem-concurrent-ruby' packages of Photon OS have been released...

The vulnerability of the YARD documentation generation and hosting tool, written in the Ruby programming language, arises from an incorrect limitation on the path to the directory. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the YARD tool for generating and hosting documentation in the Ruby programming language is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Critical Photon OS Security Update - PHSA-2026-5.0-90-0929

Updates of 'rubygem-concurrent-ruby' packages of Photon OS have been released...

GHSA-X2F5-4PRF-W687 Ruby json: JSON generator heap buffer overflow when streaming to an IO

Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...

EUVD-2026-40626

Ruby json: JSON generator heap buffer overflow when streaming to an IO...

Ruby json: JSON generator heap buffer overflow when streaming to an IO

Summary JSON.dumpobj, io and JSON::Stategenerateobj, io can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash /...

GHSA-5QHF-9PHG-95M2 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-8WHX-365G-H9VV vulnerabilities

Vulnerabilities for packages: pghero, ruby3.4-rails, commercial-gitlab-rails-ee-fips, ruby3.3-rails, commercial-gitlab-rails-ee, pghero-fips, gitlab-rails-ce-fips, ruby4.0-rails, gitlab-rails-ce, ruby3.2-rails...

GHSA-CJ75-F6XR-R4G7 vulnerabilities

Vulnerabilities for packages: pghero, ruby3.4-rails, commercial-gitlab-rails-ee-fips, ruby3.3-rails, commercial-gitlab-rails-ee, pghero-fips, gitlab-rails-ce-fips, ruby4.0-rails, gitlab-rails-ce, ruby3.2-rails...

GHSA-9WJQ-CP2P-HRGF vulnerabilities

Vulnerabilities for packages: pghero, ruby3.4-rails, commercial-gitlab-rails-ee-fips, ruby3.3-rails, commercial-gitlab-rails-ee, pghero-fips, gitlab-rails-ce-fips, ruby4.0-rails, gitlab-rails-ce, ruby3.2-rails...

Critical Photon OS Security Update - PHSA-2026-5.0-0927

Updates of 'rubygem-fluentd' packages of Photon OS have been released...

websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...