16830 matches found
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...
CVE-2026-71847
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
EUVD-2026-54576
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
CVE-2026-71847 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
CVE-2026-71847
Ruby JSON: ResumableParser in the native C extension (Ruby JSON) from versions 2.20.0–2.21.2 allocates correctly but after consuming input, state.start/state.cursor/state.end point into freed storage. When partial_value processes a truncated object with duplicate keys, cursor_position dereference...
CVE-2026-71847
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
CVE-2026-71847 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...
ruby:3.3 security, bug fix, and enhancement update
ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 rubygem-mysql2 0.5.5-3 - Disable tests on the 32bit platforms ix86. Related: RHEL-80222 0.5.5-2 - Adapt tests to openssl 3.2 Resolves: RHEL-80222 0.5.5-1 - Upgrade to mysql2 0.5.5. Related: RHEL-17089 rubygem-pg...
Ruby oj Gem < 3.17.2 Stack Buffer Overflow
The version of the oj Ruby gem installed on the remote host is prior to 3.17.2. It is, therefore, affected by a stack buffer overflow vulnerability. - Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fillindent in dump.h calls...
CVE-2026-54619
A flaw was found in sqlite3-ruby. When a SQLite function is redefined with a different number of arguments arity, the previously registered function handler is prematurely freed. This can lead to a use-after-free vulnerability, where the program attempts to access memory that has already been...
GHSA-H663-9FGH-W7XF vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch...
GHSA-727X-48VV-8CJ7 vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch...
GHSA-4MRV-5P47-P938 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset...
CVE-2026-63263 vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch...
CVE-2026-63144 vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch...
GHSA-5V5G-HVW6-X2X7 vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch...
CVE-2026-54522 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset...
CVE-2026-56144 vulnerabilities
Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch, ruby4.0-elasticsearch, ruby3.4-elasticsearch...