CVE-2026-47240: Improper Neutralization of Special Elements used in a Command

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, logstash, ruby3.4-rails, kube-logging-operator...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator...

Photon OS 5.0: Ruby PHSA-2026-5.0-0882

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0882. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking in the releasewritelock and releasereadlock functions. An attacker can disrupt synchronization guarantees and exploit data races or cause denial of service by invoking these functions from unauthorized threads or withou...

GHSA-6WX8-W4F5-WWCR Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

Summary Concurrent::ReadWriteLockreleasewritelock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still...

Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

Summary Concurrent::ReadWriteLockreleasewritelock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still...

Wrap-around Error

Overview Affected versions of this package are vulnerable to Wrap-around Error in ReentrantReadWriteLock that causes incorrect write locks. An attacker can cause a thread to incorrectly obtain a write lock without exclusivity by repeatedly acquiring the read lock 32,768 times, which overflows the...

GHSA-WV3X-4VXV-WHPP Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Summary Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITELOCKHELD...

Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

Summary Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times. The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITELOCKHELD...