ruby security, bug fix, and enhancement update

3.3.12-14 - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659...

ruby4.0 security, bug fix, and enhancement update

4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660...

Linux Distros Unpatched Vulnerability : CVE-2026-67990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An...

Linux Distros Unpatched Vulnerability : CVE-2026-67986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially...

MiracleLinux 9 : ruby:3.3 (AXSA:2026-1541:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1541:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1542:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1542:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

Oracle Linux 10 : ruby (ELSA-2026-50778)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50778 advisory. 3.3.12-14 - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659 Tenable has extracted the preceding description block directly from t...

Linux Distros Unpatched Vulnerability : CVE-2026-73648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...

Oracle Linux 10 : ruby4.0 (ELSA-2026-50773)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50773 advisory. 4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660 Tenable has extracted the preceding description block directly from the...

CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, ruby3.2-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: pghero, pghero-fips, ruby3.4-rails, gitlab-rails-ce, gitlab-rails-ce-fips, ruby4.0-rails, commercial-gitlab-rails-ee-fips, ruby3.3-rails, commercial-gitlab-rails-ee, ruby3.2-rails...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: pghero, pghero-fips, ruby3.4-rails, gitlab-rails-ce, gitlab-rails-ce-fips, ruby4.0-rails, commercial-gitlab-rails-ee-fips, ruby3.3-rails, commercial-gitlab-rails-ee, ruby3.2-rails...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

UBUNTU-CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-67986

A flaw was found in amazingprint. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. The flaw occurs when the grep method is called with a block, and a specially crafted method name containing Ruby interpolation syntax is processed. Successful...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in rbsqlite3aggregatorstep in ext/sqlite3/aggregator.c. An attacker can make the aggregate step method receive a wrong or freed Ruby object, or crash the process, by invoking a multi-argument aggregate over...