ruby4.0 security, bug fix, and enhancement update

4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660...

ruby security, bug fix, and enhancement update

3.3.12-14 - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1542:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1542:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

Linux Distros Unpatched Vulnerability : CVE-2026-73648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...

Linux Distros Unpatched Vulnerability : CVE-2026-67986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially...

Oracle Linux 10 : ruby4.0 (ELSA-2026-50773)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50773 advisory. 4.0.6-36 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660 Tenable has extracted the preceding description block directly from the...

CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, ruby3.3-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, ruby3.3-rails...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...

CVE-2026-73427 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails...

CVE-2026-73490 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, ruby3.3-rails, gitlab-rails-ce, ruby3.2-rails, commercial-gitlab-rails-ee, pghero, ruby4.0-rails, ruby3.4-rails, pghero-fips...

CVE-2026-73491 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, ruby3.3-rails, gitlab-rails-ce, ruby3.2-rails, commercial-gitlab-rails-ee, pghero, ruby4.0-rails, ruby3.4-rails, pghero-fips...

UBUNTU-CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-67986

A flaw was found in amazingprint. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. The flaw occurs when the grep method is called with a block, and a specially crafted method name containing Ruby interpolation syntax is processed. Successful...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in rbsqlite3aggregatorstep in ext/sqlite3/aggregator.c. An attacker can make the aggregate step method receive a wrong or freed Ruby object, or crash the process, by invoking a multi-argument aggregate over...

DEBIAN-CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...