Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3546)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243546 advisory. ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Buffer overread vulnerability in StringIO CVE-2024-27280 ruby: Arbitrary memory...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1779745996)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779745996 advisory. - ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard ...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_1431)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241431 advisory. ruby/cgi-gem: HTTP response splitting in CGI CVE-2021-33621 ruby: ReDoS vulnerability in URI CVE-2023-28755 ruby: ReDoS vulnerability - upstream's incomple...

Rocky Linux 9 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_4493)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254493 advisory. net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion CVE-2025-25186 CGI: Denial of Service in CGI::Cookie.parse CVE-2025-27219 uri: userinfo...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1782469374)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782469374 advisory. - A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777444043)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777444043 advisory. - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2022_6447)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226447 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2022_6450)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226450 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2022_5779)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225779 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1759222758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1759222758 advisory. - Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as retval...

[SECURITY] [DLA-4803-1] ruby-oj security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4803-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley September 30, 2026 https://wiki.debian.org/LTS -...

CVE-2026-55107

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...

CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...

EUVD-2026-90197

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

CVE-2026-55107: Improper Control of Generation of Code

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1768314331)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768314331 advisory. - In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication...

RHEL 8 : ruby:2.5 (RHSA-2026:73519)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73519 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1779099998)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779099998 advisory. - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have...