PT-2026-65518

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select eval custom field type. Attackers can store an...

PT-2026-65537

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

Linux Distros Unpatched Vulnerability : CVE-2026-49158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0...

PT-2026-65538

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertoken request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

PT-2026-65634

Summary Using Databasecreate function or Databasedefine function to define the same function name more than once with different numbers of arguments "arity" or text encodings will result in a invalid memory read and a segmentation fault. Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a...

TencentOS Server 2: ruby (TSSA-2026:0763)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0763 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

DEBIAN-CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

EUVD-2026-49151

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

CVE-2026-49158 describes an Improper Handling of Highly Compressed Data (Data Amplification) in the Apache Thrift Ruby bindings (THeaderTransport). The issue affects Thrift versions before 0.24.0. The vulnerability allows amplification of data via ZLIB decompression, which can impact availability...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB transform in lib/rb/lib/thrift/transport/headertransport.rb. An attacker can trigger memory and CPU...

CVE-2026-49158 Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-49158

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-64883

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Ruby bindings. This issue occurs during ZLIB decompression within the THeaderTransport...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...