RLSA-2026:72286 Important: ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Bug Fixes and...

CVE-2026-67987: Inefficient Regular Expression Complexity

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

CVE-2026-67987

The crmne/ruby_llm library (specifically at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 ) is vulnerable to a polynomial-time regular expression denial-of-service (ReDoS) . The issue exists during think-tag response parsing on Ruby 3.1.x . A malicious or anomalous model response containing num...

EUVD-2026-89427

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

Oracle Linux 9 : ruby:4.0 (ELSA-2026-72484)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72484 advisory. - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 - Fix...

ruby:4.0 security update

ruby 4.0.6-35 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 4.0.3-33 - Fix Net::IMAP ResponseReader quadratic...

Oracle Linux 10 : ruby (ELSA-2026-72785)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72785 advisory. 3.3.12-15 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252031 Tenable has extracted the preceding descripti...

RHEL 10 : ruby4.0 (RHSA-2026:72427)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72427 advisory. Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do...

RockyLinux 9 : ruby:3.3 (RLSA-2026:72485)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72485 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Tenable has extracted the preceding description...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

ruby:3.3 security update

ruby 3.3.12-9 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252039 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 3.3.10-7 - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181693 - Fix...

RHEL 9 : ruby:3.3 (RHSA-2026:72485)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72485 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

RockyLinux 9 : ruby (RLSA-2026:72286)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72286 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 Bug Fixes and Enhancements: ruby %check fails in...

ruby:3.3 security update

ruby 3.3.12-9 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252036 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 3.3.10-7 - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181682 - Fix...

ruby security, bug fix, and enhancement update

3.0.7-168 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252044 3.0.7-167 - Fix information disclosure via MITM attack bypassing TLS in net-imap. CVE-2026-42246 Resolves: RHEL-181763 - Fix command injection via Symbol arguments in net-imap...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-72485)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72485 advisory. - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252039 - Fix DoS via crafted IMAP responses in net-imap...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

SUSE CVE-2026-80212

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...

ruby:3.3 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.ruby, ruby, rubygem-pg, module.rubygem-pg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

RLSA-2026:72484 Important: ruby:4.0 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 For more details...