19097 matches found
PT-2026-69102
Name of the Vulnerable Software and Affected Versions Ruby JSON versions 2.20.0 through 2.21.1 Description Ruby's JSON native C extension contains a heap-use-after-free issue. The JSON::ResumableParser clears its input buffer but fails to reset the state.start, state.cursor, and state.end pointer...
CVE-2026-48122: Improper Neutralization of Special Elements used in an OS Command
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...
CVE-2026-71847: Use After Free
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
Ruby oj Gem < 3.17.2 Stack Buffer Overflow
The version of the oj Ruby gem installed on the remote host is prior to 3.17.2. It is, therefore, affected by a stack buffer overflow vulnerability. - Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fillindent in dump.h calls...
Ruby JSON - JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...
PT-2026-69159
Name of the Vulnerable Software and Affected Versions Ruby LSP VS Code extension versions prior to 0.10.4 Description Workspace-level settings in the extension can be manipulated via a .vscode/settings.json file in a malicious repository. An attacker can override the path to the Ruby executable,...
ruby:3.3 security, bug fix, and enhancement update
ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 rubygem-mysql2 0.5.5-3 - Disable tests on the 32bit platforms ix86. Related: RHEL-80222 0.5.5-2 - Adapt tests to openssl 3.2 Resolves: RHEL-80222 0.5.5-1 - Upgrade to mysql2 0.5.5. Related: RHEL-17089 rubygem-pg...
Linux Distros Unpatched Vulnerability : CVE-2026-71847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but...
CVE-2026-54619
A flaw was found in sqlite3-ruby. When a SQLite function is redefined with a different number of arguments arity, the previously registered function handler is prematurely freed. This can lead to a use-after-free vulnerability, where the program attempts to access memory that has already been...
ronin-exploits
ronin-exploits !CIhttps://github.com/ronin-rb/ronin-explo...
EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2908)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2949)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
CVE-2026-63144 vulnerabilities
Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby3.2-elasticsearch...
CVE-2026-63263 vulnerabilities
Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby3.2-elasticsearch...
GHSA-727X-48VV-8CJ7 vulnerabilities
Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby3.2-elasticsearch...
GHSA-H663-9FGH-W7XF vulnerabilities
Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby3.2-elasticsearch...
CVE-2026-54522 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator...
GHSA-5V5G-HVW6-X2X7 vulnerabilities
Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby3.2-elasticsearch...
