CVE-2026-45363: Improper Authentication

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decodetoken, '', true, algorithm: 'HS256' accepts an attacker-forged token because OpenSSL::HMAC.digest'SHA256', '', payload returns a valid digest under an empty key and no empty-key...

CVE-2026-47736: Uncontrolled Resource Consumption

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-2711)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-2670)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS

A flaw was found in the Ruby net-imap library. When upgrading a cleartext IMAP connection to TLS using the Net::IMAPstarttls method, the library improperly handles certain responses received during STARTTLS negotiation. A man-in-the-middle MITM attacker can inject a predicted tagged OK response...

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses

A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol IMAP client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can...

ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...

net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation

A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol IMAP client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the enable command. A remote attacker could exploit this by injecting...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.10-31.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.10-31.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.10-31.hum1 noarch ruby3.4-devel-3.4.10-31.hum1 aarch64, x8664...

MiracleLinux 8 : ruby:2.5 (AXSA:2026-1244:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1244:01 advisory. ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments CVE-2026-42258 net-imap: ruby: Net::IMAP: Information disclosure via...

RHSA-2026:37397 Red Hat Security Advisory: ruby security update

Bulletin has no description...

RHSA-2026:37238 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-2567)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-2627)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

MiracleLinux 8 : ruby:3.3 (AXSA:2026-1246:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1246:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

Security Bulletin: Multiple vulnerabilities in IBM Software Support App

Summary Multiple vulnerabilities were addressed in IBM Software Support App Version 4.1.1 Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml...

ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...