GHSA-Q2MW-FVJ9-VVCW vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

GHSA-HM49-WCQC-G2XG vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

CVE-2026-42256 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

CVE-2026-42245 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

CVE-2026-42246 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

GHSA-75XQ-5H9V-W6PX vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

CVE-2026-42257 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

CVE-2026-42258 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

GHSA-VCGP-9326-PQCP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby4.0-rails, ruby3.4-net-imap, ruby3.4-rails, logstash, truffleruby, kube-logging-operator, ruby3.2-net-imap, logstash-fips, ruby3.3-net-imap, ruby3.2-rails, kube-fluentd-operator, ruby4.0-net-imap, ruby3.3-rails, jruby, gitlab-rails-ce...

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's maxquerystringtokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this...

Allocation of Resources Without Limits or Throttling

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper counting of comment tokens in the maxquerystringtokens configuration. An attacker can cause excessive resource...

GHSA-3H96-34P3-XM76 GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's maxquerystringtokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. GraphQL-CParser is not affected by this...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.15.2 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP reque...

GHSA-87PF-FPWV-P7M7 net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Summary When authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. Details A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the...

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Summary When authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. Details A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the...

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Summary When authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. Details A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the...

RHCOS 6 : ruby193-ruby, rubygem-json and rubygem-rdoc (RHSA-2013:0701)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0701 advisory. - rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template CVE-2013-0256 -...

RHCOS 6 : rubygem (RHSA-2013:0728)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0728 advisory. - rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template CVE-2013-0256 Note that Nessus h...

RHCOS 1 : ruby193-ruby (RHSA-2013:1137)

The remote Red Hat Enterprise Linux CoreOS 1 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1137 advisory. - ruby: hostname check bypassing vulnerability in SSL client CVE-2013-4073 Note that Nessus has not tested for this issue but has instead...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...