OPENSUSE-SU-2026:21878-1

Vulnerability from csaf_opensuse - Published: 2026-09-18 13:34 - Updated: 2026-09-24 17:48
Summary
Security update for ruby3.4
Severity
Important
Notes
Title of the patch: Security update for ruby3.4
Description of the patch: This update for ruby3.4 fixes the following issues: - CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016). - CVE-2026-27820: insufficient checks in `zstream_buffer_ungets` can lead to a buffer overflow (bsc#1259239). - CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441). - CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011). - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument (bsc#1268337). - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338). - CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339). - CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833). Changes for ruby3.4: - Update to 3.4.10. - Update to 3.4.9: - Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System - Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue - Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System - Bug #21326: Instruction generation differences between parse.y and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue - Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby - Ruby Issue Tracking System - Bug #21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System - Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue - Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System - Bug #21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue - Bug #21860: Process.fork: the child may deadlock on th->interrupt_lock in threadptr_interrupt_exec_cleanup - Ruby - Ruby Issue Tracking System - Bug #21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System - Update to 3.4.8: - Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System - Bug #21626: Backport WASI setjmp handler memory leak fixes - Ruby - Ruby Issue Tracking System - Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby Issue Tracking System - Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) - - Bug #21644: Stack consistency error for the newrange INSN peephole optimization with chilled string - Ruby - Ruby Issue - Bug #21668: Improve performance of UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue - Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby - Bug #21652: Marshal#dump documentation out-of-date/unclear regarding Data class - Ruby - Ruby Issue Tracking System - Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters - - Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System - Bug #21671: Rails CI raises Assertion Failed: rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual type: 26 with "-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" enabled - - Update next stable version to 4.0 from 3.5 by hsbt . Pull Request #15146 - Bug #21679: Segfault when ruby calls pthread_detach in rb_getnameinfo - Ruby - Ruby Issue Tracking System - Bug #21694: Crash when looking up super method from BasicObject - Ruby - Ruby Issue Tracking System - Bug #21707: Destructuring assignment of SimpleDelegator wrapped array bug with YJIT - Ruby - Ruby Issue Tracking System - Bug #21265: Crash when proc from Symbol#to_proc called outside refinement scope - Ruby - Ruby Issue Tracking System - Bug #21703: RUBY_CRASH_REPORT does not work when shelling out in some cases - Ruby - Ruby Issue Tracking System - Bug #21666: Math.lgamma(-1).should == [infinity_value, 1] fails with Fedora glibc-2.42.9000-8.fc44 - Ruby - Ruby Issue Tracking System - Bug #21655: segfault when building 3.3.10 with GCC 15.2.1, regression from 3.3.9 - Ruby - Ruby Issue Tracking System - Bug #21680: Integer#digits bug starting from Ruby 3.1 - Ruby - - Bug #21705: UNIXServer.open(nil) segfaults on Windows - Ruby - - Bug #21648: [prism] ruby crashes for for * in [10]; end - Ruby - Bug #21187: Strings concatenated with \ getting frozen with literal hashes (PRISM only) - Ruby - Ruby Issue Tracking System - Bug #21772: ruby: YJIT has panicked StackOpnd(1) should be a heap object, but was ImmSymbol for VALUE(137647867319760) - - Bug #21446: StackOverflow when changing visibility in reopened refinement - Ruby - Ruby Issue Tracking System - Bug #21779: Do not export functions from statically linked extensions - Ruby - Ruby Issue Tracking System - Bug #21266: YJIT GC safety crash with proc objects as block argument - Ruby - Ruby Issue Tracking System
Patchnames: openSUSE-Leap-16.0-1705
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-58767
2.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch —
Vendor Fix
Threats
Impact low
CVE-2025-61594
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact moderate
CVE-2026-27820
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact important
CVE-2026-41316
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact important
CVE-2026-42258
5.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact moderate
CVE-2026-47240
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact moderate
CVE-2026-47241
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact moderate
CVE-2026-47242
6.8 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected products
Recommended 11 products, the same list as for CVE-2025-58767
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1250016 self
https://bugzilla.suse.com/1255833 self
https://bugzilla.suse.com/1259239 self
https://bugzilla.suse.com/1262441 self
https://bugzilla.suse.com/1268011 self
https://bugzilla.suse.com/1268337 self
https://bugzilla.suse.com/1268338 self
https://bugzilla.suse.com/1268339 self
https://www.suse.com/security/cve/CVE-2025-58767/ self
https://www.suse.com/security/cve/CVE-2025-61594/ self
https://www.suse.com/security/cve/CVE-2026-27820/ self
https://www.suse.com/security/cve/CVE-2026-41316/ self
https://www.suse.com/security/cve/CVE-2026-42258/ self
https://www.suse.com/security/cve/CVE-2026-47240/ self
https://www.suse.com/security/cve/CVE-2026-47241/ self
https://www.suse.com/security/cve/CVE-2026-47242/ self
https://www.suse.com/security/cve/CVE-2025-58767 external
https://bugzilla.suse.com/1250016 external
https://www.suse.com/security/cve/CVE-2025-61594 external
https://bugzilla.suse.com/1251273 external
https://bugzilla.suse.com/1255833 external
https://www.suse.com/security/cve/CVE-2026-27820 external
https://bugzilla.suse.com/1259239 external
https://www.suse.com/security/cve/CVE-2026-41316 external
https://bugzilla.suse.com/1262441 external
https://www.suse.com/security/cve/CVE-2026-42258 external
https://bugzilla.suse.com/1268011 external
https://www.suse.com/security/cve/CVE-2026-47240 external
https://bugzilla.suse.com/1268337 external
https://www.suse.com/security/cve/CVE-2026-47241 external
https://bugzilla.suse.com/1268338 external
https://www.suse.com/security/cve/CVE-2026-47242 external
https://bugzilla.suse.com/1268339 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for ruby3.4",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for ruby3.4 fixes the following issues:\n\n- CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016).\n- CVE-2026-27820: insufficient checks in `zstream_buffer_ungets` can lead to a buffer overflow (bsc#1259239).\n- CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).\n- CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011).\n- CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in \"raw\" argument (bsc#1268337).\n- CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).\n- CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).\n- CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833).\n\nChanges for ruby3.4:\n\n- Update to 3.4.10.\n\n- Update to 3.4.9:\n\n - Bug #21715: Miscompilation on x86-64-v2 due to undefined\n behavior in search_nonascii in string.c - Ruby - Ruby Issue\n Tracking System\n - Bug #21787: IO::Buffer Integer Overflow in Range Validation\n Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue\n - Bug #21757: Splatted args array is mutated when passing\n unexpected kwargs - Ruby - Ruby Issue Tracking System\n - Bug #21326: Instruction generation differences between parse.y\n and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue\n - Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby\n - Ruby Issue Tracking System\n - Bug #21819: A Data object should be frozen even if it has no\n members - Ruby - Ruby Issue Tracking System\n - Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue\n - Bug #21838: Rails seeing degradation (20% slowdown) related to\n Revision 079ef92b \"Implement global allocatable slots and empty\n pages\" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System\n - Bug #21931: GC Crash in String#% (backport\n 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue\n - Bug #21860: Process.fork: the child may deadlock on\n th-\u003einterrupt_lock in threadptr_interrupt_exec_cleanup - Ruby -\n Ruby Issue Tracking System\n - Bug #21873: UnboundMethod#== returns false for methods from\n included/extended modules - Ruby - Ruby Issue Tracking System\n\n- Update to 3.4.8:\n\n  - Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe\n warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System\n - Bug #21626: Backport WASI setjmp handler memory leak fixes -\n Ruby - Ruby Issue Tracking System\n - Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby\n Issue Tracking System\n - Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) -\n - Bug #21644: Stack consistency error for the newrange INSN\n peephole optimization with chilled string - Ruby - Ruby Issue\n - Bug #21668: Improve performance of\n UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue\n - Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby\n - Bug #21652: Marshal#dump documentation out-of-date/unclear\n regarding Data class - Ruby - Ruby Issue Tracking System\n - Bug #13671: Regexp with lookbehind and case-insensitivity\n raises RegexpError only on strings with certain characters -\n - Bug #21625: Allow IO#wait_readable together with IO#ungetc even\n in text mode - Ruby - Ruby Issue Tracking System\n - Bug #21671: Rails CI raises Assertion Failed:\n rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual\n type: 26 with \"-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1\" enabled -\n - Update next stable version to 4.0 from 3.5 by hsbt . Pull\n Request #15146\n - Bug #21679: Segfault when ruby calls pthread_detach in\n rb_getnameinfo - Ruby - Ruby Issue Tracking System\n - Bug #21694: Crash when looking up super method from BasicObject\n - Ruby - Ruby Issue Tracking System\n - Bug #21707: Destructuring assignment of SimpleDelegator wrapped\n array bug with YJIT - Ruby - Ruby Issue Tracking System\n - Bug #21265: Crash when proc from Symbol#to_proc called outside\n refinement scope - Ruby - Ruby Issue Tracking System\n - Bug #21703: RUBY_CRASH_REPORT does not work when shelling out\n in some cases - Ruby - Ruby Issue Tracking System\n - Bug #21666: Math.lgamma(-1).should == [infinity_value, 1] fails\n with Fedora glibc-2.42.9000-8.fc44 - Ruby - Ruby Issue Tracking\n System\n - Bug #21655: segfault when building 3.3.10 with GCC 15.2.1,\n regression from 3.3.9 - Ruby - Ruby Issue Tracking System\n - Bug #21680: Integer#digits bug starting from Ruby 3.1 - Ruby -\n - Bug #21705: UNIXServer.open(nil) segfaults on Windows - Ruby -\n - Bug #21648: [prism] ruby crashes for for * in [10]; end - Ruby\n - Bug #21187: Strings concatenated with \\ getting frozen with\n literal hashes (PRISM only) - Ruby - Ruby Issue Tracking System\n - Bug #21772: ruby: YJIT has panicked StackOpnd(1) should be a\n heap object, but was ImmSymbol for VALUE(137647867319760) -\n - Bug #21446: StackOverflow when changing visibility in reopened\n refinement - Ruby - Ruby Issue Tracking System\n - Bug #21779: Do not export functions from statically linked\n extensions - Ruby - Ruby Issue Tracking System\n - Bug #21266: YJIT GC safety crash with proc objects as block\n argument - Ruby - Ruby Issue Tracking System\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1705",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21878-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250016",
        "url": "https://bugzilla.suse.com/1250016"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1255833",
        "url": "https://bugzilla.suse.com/1255833"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259239",
        "url": "https://bugzilla.suse.com/1259239"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262441",
        "url": "https://bugzilla.suse.com/1262441"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268011",
        "url": "https://bugzilla.suse.com/1268011"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268337",
        "url": "https://bugzilla.suse.com/1268337"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268338",
        "url": "https://bugzilla.suse.com/1268338"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268339",
        "url": "https://bugzilla.suse.com/1268339"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58767 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58767/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-61594 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-61594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27820 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27820/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41316 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41316/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42258 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42258/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-47240 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-47240/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-47241 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-47241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-47242 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-47242/"
      }
    ],
    "title": "Security update for ruby3.4",
    "tracking": {
      "current_release_date": "2026-09-24T17:48:02Z",
      "generator": {
        "date": "2026-09-18T13:34:12Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21878-1",
      "initial_release_date": "2026-09-18T13:34:12Z",
      "revision_history": [
        {
          "date": "2026-09-18T13:34:12Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-24T17:48:02Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch",
                "product": {
                  "name": "ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch",
                  "product_id": "ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-doc-ri@3.4.10-160000.1.1?arch=noarch\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
                "product": {
                  "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
                  "product_id": "libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libruby3_4-3_4@3.4.10-160000.1.1?arch=ppc64le\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-0:3.4.10-160000.1.1.ppc64le",
                "product": {
                  "name": "ruby3.4-0:3.4.10-160000.1.1.ppc64le",
                  "product_id": "ruby3.4-0:3.4.10-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4@3.4.10-160000.1.1?arch=ppc64le\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
                "product": {
                  "name": "ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
                  "product_id": "ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-devel@3.4.10-160000.1.1?arch=ppc64le\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
                "product": {
                  "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
                  "product_id": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-devel-extra@3.4.10-160000.1.1?arch=ppc64le\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
                "product": {
                  "name": "ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
                  "product_id": "ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-doc@3.4.10-160000.1.1?arch=ppc64le\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
                "product": {
                  "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
                  "product_id": "libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libruby3_4-3_4@3.4.10-160000.1.1?arch=x86_64\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-0:3.4.10-160000.1.1.x86_64",
                "product": {
                  "name": "ruby3.4-0:3.4.10-160000.1.1.x86_64",
                  "product_id": "ruby3.4-0:3.4.10-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4@3.4.10-160000.1.1?arch=x86_64\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
                "product": {
                  "name": "ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
                  "product_id": "ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-devel@3.4.10-160000.1.1?arch=x86_64\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
                "product": {
                  "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
                  "product_id": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-devel-extra@3.4.10-160000.1.1?arch=x86_64\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
                "product": {
                  "name": "ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
                  "product_id": "ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ruby-lang:ruby:3.4.10:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/ruby3.4-doc@3.4.10-160000.1.1?arch=x86_64\u0026upstream=ruby3.4-0:3.4.10-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le"
        },
        "product_reference": "libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64"
        },
        "product_reference": "libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-0:3.4.10-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le"
        },
        "product_reference": "ruby3.4-0:3.4.10-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-0:3.4.10-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64"
        },
        "product_reference": "ruby3.4-0:3.4.10-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le"
        },
        "product_reference": "ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-devel-0:3.4.10-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64"
        },
        "product_reference": "ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le"
        },
        "product_reference": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64"
        },
        "product_reference": "ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le"
        },
        "product_reference": "ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-doc-0:3.4.10-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64"
        },
        "product_reference": "ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        },
        "product_reference": "ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-58767",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58767"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58767",
          "url": "https://www.suse.com/security/cve/CVE-2025-58767"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250016 for CVE-2025-58767",
          "url": "https://bugzilla.suse.com/1250016"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-58767"
    },
    {
      "cve": "CVE-2025-61594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-61594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-61594",
          "url": "https://www.suse.com/security/cve/CVE-2025-61594"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251273 for CVE-2025-61594",
          "url": "https://bugzilla.suse.com/1251273"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255833 for CVE-2025-61594",
          "url": "https://bugzilla.suse.com/1255833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-61594"
    },
    {
      "cve": "CVE-2026-27820",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27820"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27820",
          "url": "https://www.suse.com/security/cve/CVE-2026-27820"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259239 for CVE-2026-27820",
          "url": "https://bugzilla.suse.com/1259239"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27820"
    },
    {
      "cve": "CVE-2026-41316",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41316"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41316",
          "url": "https://www.suse.com/security/cve/CVE-2026-41316"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262441 for CVE-2026-41316",
          "url": "https://bugzilla.suse.com/1262441"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-41316"
    },
    {
      "cve": "CVE-2026-42258",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42258"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42258",
          "url": "https://www.suse.com/security/cve/CVE-2026-42258"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268011 for CVE-2026-42258",
          "url": "https://bugzilla.suse.com/1268011"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-42258"
    },
    {
      "cve": "CVE-2026-47240",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-47240"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a \"raw data\" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.  A server without support for non-synchronizing literals may interpret the \"+}\\r\\n\" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-47240",
          "url": "https://www.suse.com/security/cve/CVE-2026-47240"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268337 for CVE-2026-47240",
          "url": "https://bugzilla.suse.com/1268337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-47240"
    },
    {
      "cve": "CVE-2026-47241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-47241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-47241",
          "url": "https://www.suse.com/security/cve/CVE-2026-47241"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268338 for CVE-2026-47241",
          "url": "https://bugzilla.suse.com/1268338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-47241"
    },
    {
      "cve": "CVE-2026-47242",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-47242"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
          "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-47242",
          "url": "https://www.suse.com/security/cve/CVE-2026-47242"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268339 for CVE-2026-47242",
          "url": "https://bugzilla.suse.com/1268339"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libruby3_4-3_4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-devel-extra-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:ruby3.4-doc-0:3.4.10-160000.1.1.x86_64",
            "openSUSE Leap 16.0:ruby3.4-doc-ri-0:3.4.10-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-18T13:34:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-47242"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.