Astra Linux – Vulnerability in Ruby 2.5

REXML is an XML toolkit for Ruby. The REXML gem before version 3.3.1 has some DoS vulnerabilities when it parses XML that contains many special characters such as . If you need to parse untrusted XMLs, you may be affected by these vulnerabilities. The REXML gem version 3.3.2 or later includes...

CVE-2026-63263 vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby3.3-elasticsearch...

MiracleLinux 9 : ruby-3.0.7-167.el9_8 (AXSA:2026-1454:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1454:04 advisory. ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments CVE-2026-42258 net-imap: ruby: Net::IMAP: Information disclosure via...

TencentOS Server 3: ruby:3.3 (TSSA-2026:0657)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0657 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Fedora 43 : ruby (2026-7b7c2b373e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7b7c2b373e advisory. Ruby 3.4.10 is released. This new version contains severay security bug fixes in zlib, net-imap and erb.. Tenable has extracted the preceding...

SUSE-SU-2026:3090-1 Security update for ruby3.4

This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in 'raw' argument bsc1268337. - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.3: ruby3.3-3.3.10-23.4.hum1 aarch64, x8664 ruby3.3-bundled-gems-3.3.10-23.4.hum1 aarch64, x8664 ruby3.3-default-gems-3.3.10-23.4.hum1 noarch ruby3.3-devel-3.3.10-23.4.hum1 aarch64, x8664...

RHEL 9 : ruby:3.3 (RHSA-2026:37238)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37238 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

RHSA-2026:36099 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

RHEL 9 : ruby:3.3 (RHSA-2026:36099)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36099 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

RHEL 8 : ruby:2.5 (RHSA-2026:35867)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:35867 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-33576)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33576 advisory. - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181693 - Fix information disclosure via MITM attack bypassing TLS in...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.8-31.3.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.8-31.3.hum1 noarch ruby3.4-devel-3.4.8-31.3.hum1 aarch64, x8664...

AlmaLinux 9 : ruby:3.3 (ALSA-2026:33576)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:33576 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol...

RHEL 8 : ruby:2.5 (RHSA-2026:33514)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33514 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

GHSA-475M-PH3X-64GP vulnerabilities

Vulnerabilities for packages: ruby3.3-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset...

AlmaLinux 8 : ruby:3.3 (ALSA-2026:20614)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:20614 advisory. erb: ERB: Arbitrary code execution via deserialization bypass CVE-2026-41316 Tenable has extracted the preceding description block directly from the AlmaLinux...

Important: Red Hat Security Advisory: ruby:3.3 security update

An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2026:20614 Important: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: erb: ERB: Arbitrary code execution via deserialization bypass CVE-2026-41316 For more details about the security issues, including...

CVE-2026-41316

ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods th...