RHSA-2026:8838

Vulnerability from csaf_redhat - Published: 2026-04-17 23:15 - Updated: 2026-04-21 13:32
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.0-33.3.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.0-33.3.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.0-33.3.hum1 (noarch) * ruby4.0-devel-4.0.0-33.3.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.0-33.3.hum1 (noarch) * ruby4.0-libs-4.0.0-33.3.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-33.3.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.3-33.3.hum1 (noarch) * rubygem4.0-devel-4.0.3-33.3.hum1 (noarch) * rubygem4.0-io-console-0.8.2-33.3.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-33.3.hum1 (noarch) * rubygem4.0-json-2.18.0-33.3.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-33.3.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-33.3.hum1 (noarch) * rubygem4.0-psych-5.3.1-33.3.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-33.3.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-33.3.hum1 (noarch) * rubygem4.0-rbs-3.10.0-33.3.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.3-33.3.hum1 (noarch) * rubygem4.0-rexml-3.4.4-33.3.hum1 (noarch) * rubygem4.0-rss-0.3.2-33.3.hum1 (noarch) * rubygem4.0-rubygems-4.0.3-33.3.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-33.3.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-33.3.hum1 (noarch) * ruby4.0-4.0.0-33.3.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2008-1891

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.

5.0 ()
AV:N/AC:L/Au:N/C:P/I:N/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2008-3655

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2008-3656

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2008-3657

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2008-3905

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2011-4815

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

5.0 ()
AV:N/AC:L/Au:N/C:N/I:N/A:P
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2012-5371

Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.

5.0 ()
AV:N/AC:L/Au:N/C:N/I:N/A:P
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2013-1821

lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

4.3 ()
AV:N/AC:M/Au:N/C:N/I:N/A:P
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2014-4975

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

2.6 ()
AV:N/AC:H/Au:N/C:N/I:N/A:P
CWE-193 - Off-by-one Error
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2014-6438

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2014-8080

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

4.3 ()
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2014-8090

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.

4.3 ()
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2015-9096

A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands in a SMTP session in order to facilitate phishing attacks or spam campaigns.

5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2017-10784

It was found that WEBrick did not sanitize all its log messages. If logs were printed in a terminal, an attacker could interact with the terminal via the use of escape sequences.

5.4 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-117 - Improper Output Neutralization for Logs
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2017-14064

A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter's heap memory.

5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2018-8780

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.

6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
Workaround It is possible to test for presence of the NULL byte manually prior to call a Dir method with an untrusted string.
CVE-2019-16254

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2021-28965

A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of processed data in applications using REXML that parse XML documents, write data back to XML, and re-parse them again.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-611 - Improper Restriction of XML External Entity Reference
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2021-31810

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from systems not accessible from the FTP server.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2021-41819

A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2022-28739

A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2023-28756

A flaw was found in the Time gem and Time library of Ruby. The Time parser mishandles invalid strings with specific characters and causes an increase in execution time for parsing strings to Time objects. This issue may result in a Regular expression denial of service (ReDoS).

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-20 - Improper Input Validation
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
CVE-2024-27282

A flaw was found in Ruby. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
Workaround Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-27820

A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstream_buffer_ungets function does not ensure sufficient memory capacity before moving existing data, which can lead to memory corruption. An attacker could potentially exploit this to cause unexpected behavior or system instability.

5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-131 - Incorrect Calculation of Buffer Size
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:8838
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
https://access.redhat.com/errata/RHSA-2026:8838 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-27820 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2008-3905 external
https://access.redhat.com/security/cve/CVE-2008-3657 external
https://access.redhat.com/security/cve/CVE-2008-3656 external
https://access.redhat.com/security/cve/CVE-2008-3655 external
https://access.redhat.com/security/cve/CVE-2024-27282 external
https://access.redhat.com/security/cve/CVE-2021-31810 external
https://access.redhat.com/security/cve/CVE-2019-16254 external
https://access.redhat.com/security/cve/CVE-2018-8780 external
https://access.redhat.com/security/cve/CVE-2017-14064 external
https://access.redhat.com/security/cve/CVE-2017-10784 external
https://access.redhat.com/security/cve/CVE-2015-9096 external
https://access.redhat.com/security/cve/CVE-2014-8090 external
https://access.redhat.com/security/cve/CVE-2014-8080 external
https://access.redhat.com/security/cve/CVE-2014-6438 external
https://access.redhat.com/security/cve/CVE-2014-4975 external
https://access.redhat.com/security/cve/CVE-2013-1821 external
https://access.redhat.com/security/cve/CVE-2012-5371 external
https://access.redhat.com/security/cve/CVE-2011-4815 external
https://access.redhat.com/security/cve/CVE-2008-1891 external
https://access.redhat.com/security/cve/CVE-2023-28756 external
https://access.redhat.com/security/cve/CVE-2022-28739 external
https://access.redhat.com/security/cve/CVE-2021-41819 external
https://access.redhat.com/security/cve/CVE-2021-28965 external
https://access.redhat.com/security/cve/CVE-2020-25613 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2008-1891 self
https://bugzilla.redhat.com/show_bug.cgi?id=443829 external
https://www.cve.org/CVERecord?id=CVE-2008-1891 external
https://nvd.nist.gov/vuln/detail/CVE-2008-1891 external
https://access.redhat.com/security/cve/CVE-2008-3655 self
https://bugzilla.redhat.com/show_bug.cgi?id=458948 external
https://www.cve.org/CVERecord?id=CVE-2008-3655 external
https://nvd.nist.gov/vuln/detail/CVE-2008-3655 external
https://access.redhat.com/security/cve/CVE-2008-3656 self
https://bugzilla.redhat.com/show_bug.cgi?id=458953 external
https://www.cve.org/CVERecord?id=CVE-2008-3656 external
https://nvd.nist.gov/vuln/detail/CVE-2008-3656 external
https://access.redhat.com/security/cve/CVE-2008-3657 self
https://bugzilla.redhat.com/show_bug.cgi?id=458966 external
https://www.cve.org/CVERecord?id=CVE-2008-3657 external
https://nvd.nist.gov/vuln/detail/CVE-2008-3657 external
https://access.redhat.com/security/cve/CVE-2008-3905 self
https://bugzilla.redhat.com/show_bug.cgi?id=461495 external
https://www.cve.org/CVERecord?id=CVE-2008-3905 external
https://nvd.nist.gov/vuln/detail/CVE-2008-3905 external
https://access.redhat.com/security/cve/CVE-2011-4815 self
https://bugzilla.redhat.com/show_bug.cgi?id=750564 external
https://www.cve.org/CVERecord?id=CVE-2011-4815 external
https://nvd.nist.gov/vuln/detail/CVE-2011-4815 external
https://access.redhat.com/security/cve/CVE-2012-5371 self
https://bugzilla.redhat.com/show_bug.cgi?id=875236 external
https://www.cve.org/CVERecord?id=CVE-2012-5371 external
https://nvd.nist.gov/vuln/detail/CVE-2012-5371 external
https://access.redhat.com/security/cve/CVE-2013-1821 self
https://bugzilla.redhat.com/show_bug.cgi?id=914716 external
https://www.cve.org/CVERecord?id=CVE-2013-1821 external
https://nvd.nist.gov/vuln/detail/CVE-2013-1821 external
http://www.ruby-lang.org/en/news/2013/02/22/rexml… external
https://access.redhat.com/security/cve/CVE-2014-4975 self
https://bugzilla.redhat.com/show_bug.cgi?id=1118158 external
https://www.cve.org/CVERecord?id=CVE-2014-4975 external
https://nvd.nist.gov/vuln/detail/CVE-2014-4975 external
https://access.redhat.com/security/cve/CVE-2014-6438 self
https://bugzilla.redhat.com/show_bug.cgi?id=1490845 external
https://www.cve.org/CVERecord?id=CVE-2014-6438 external
https://nvd.nist.gov/vuln/detail/CVE-2014-6438 external
https://www.ruby-lang.org/en/news/2014/08/19/ruby… external
https://access.redhat.com/security/cve/CVE-2014-8080 self
https://bugzilla.redhat.com/show_bug.cgi?id=1157709 external
https://www.cve.org/CVERecord?id=CVE-2014-8080 external
https://nvd.nist.gov/vuln/detail/CVE-2014-8080 external
https://www.ruby-lang.org/en/news/2014/10/27/rexm… external
https://access.redhat.com/security/cve/CVE-2014-8090 self
https://bugzilla.redhat.com/show_bug.cgi?id=1159927 external
https://www.cve.org/CVERecord?id=CVE-2014-8090 external
https://nvd.nist.gov/vuln/detail/CVE-2014-8090 external
https://www.ruby-lang.org/en/news/2014/11/13/rexm… external
https://access.redhat.com/security/cve/CVE-2015-9096 self
https://bugzilla.redhat.com/show_bug.cgi?id=1461846 external
https://www.cve.org/CVERecord?id=CVE-2015-9096 external
https://nvd.nist.gov/vuln/detail/CVE-2015-9096 external
https://access.redhat.com/security/cve/CVE-2017-10784 self
https://bugzilla.redhat.com/show_bug.cgi?id=1492012 external
https://www.cve.org/CVERecord?id=CVE-2017-10784 external
https://nvd.nist.gov/vuln/detail/CVE-2017-10784 external
https://www.ruby-lang.org/en/news/2017/09/14/webr… external
https://access.redhat.com/security/cve/CVE-2017-14064 self
https://bugzilla.redhat.com/show_bug.cgi?id=1487552 external
https://www.cve.org/CVERecord?id=CVE-2017-14064 external
https://nvd.nist.gov/vuln/detail/CVE-2017-14064 external
https://www.ruby-lang.org/en/news/2017/09/14/json… external
https://access.redhat.com/security/cve/CVE-2018-8780 self
https://bugzilla.redhat.com/show_bug.cgi?id=1561949 external
https://www.cve.org/CVERecord?id=CVE-2018-8780 external
https://nvd.nist.gov/vuln/detail/CVE-2018-8780 external
https://www.ruby-lang.org/en/news/2018/03/28/pois… external
https://access.redhat.com/security/cve/CVE-2019-16254 self
https://bugzilla.redhat.com/show_bug.cgi?id=1789556 external
https://www.cve.org/CVERecord?id=CVE-2019-16254 external
https://nvd.nist.gov/vuln/detail/CVE-2019-16254 external
https://access.redhat.com/security/cve/CVE-2020-25613 self
https://bugzilla.redhat.com/show_bug.cgi?id=1883623 external
https://www.cve.org/CVERecord?id=CVE-2020-25613 external
https://nvd.nist.gov/vuln/detail/CVE-2020-25613 external
https://www.ruby-lang.org/en/news/2020/09/29/http… external
https://access.redhat.com/security/cve/CVE-2021-28965 self
https://bugzilla.redhat.com/show_bug.cgi?id=1947526 external
https://www.cve.org/CVERecord?id=CVE-2021-28965 external
https://nvd.nist.gov/vuln/detail/CVE-2021-28965 external
https://access.redhat.com/security/cve/CVE-2021-31810 self
https://bugzilla.redhat.com/show_bug.cgi?id=1980126 external
https://www.cve.org/CVERecord?id=CVE-2021-31810 external
https://nvd.nist.gov/vuln/detail/CVE-2021-31810 external
https://www.ruby-lang.org/en/news/2021/07/07/trus… external
https://access.redhat.com/security/cve/CVE-2021-41819 self
https://bugzilla.redhat.com/show_bug.cgi?id=2026757 external
https://www.cve.org/CVERecord?id=CVE-2021-41819 external
https://nvd.nist.gov/vuln/detail/CVE-2021-41819 external
https://access.redhat.com/security/cve/CVE-2022-28739 self
https://bugzilla.redhat.com/show_bug.cgi?id=2075687 external
https://www.cve.org/CVERecord?id=CVE-2022-28739 external
https://nvd.nist.gov/vuln/detail/CVE-2022-28739 external
http://www.ruby-lang.org/en/news/2022/04/12/buffe… external
https://access.redhat.com/security/cve/CVE-2023-28756 self
https://bugzilla.redhat.com/show_bug.cgi?id=2184061 external
https://www.cve.org/CVERecord?id=CVE-2023-28756 external
https://nvd.nist.gov/vuln/detail/CVE-2023-28756 external
https://www.ruby-lang.org/en/news/2023/03/30/redo… external
https://access.redhat.com/security/cve/CVE-2024-27282 self
https://bugzilla.redhat.com/show_bug.cgi?id=2276810 external
https://www.cve.org/CVERecord?id=CVE-2024-27282 external
https://nvd.nist.gov/vuln/detail/CVE-2024-27282 external
https://www.ruby-lang.org/en/news/2024/04/23/arbi… external
https://access.redhat.com/security/cve/CVE-2026-27820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2459002 external
https://www.cve.org/CVERecord?id=CVE-2026-27820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27820 external
https://github.com/ruby/zlib/security/advisories/… external
https://hackerone.com/reports/3467067 external
Acknowledgments
oCERT
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nruby4.0:\n  * ruby4.0-4.0.0-33.3.hum1 (aarch64, x86_64)\n  * ruby4.0-bundled-gems-4.0.0-33.3.hum1 (aarch64, x86_64)\n  * ruby4.0-default-gems-4.0.0-33.3.hum1 (noarch)\n  * ruby4.0-devel-4.0.0-33.3.hum1 (aarch64, x86_64)\n  * ruby4.0-doc-4.0.0-33.3.hum1 (noarch)\n  * ruby4.0-libs-4.0.0-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-bigdecimal-4.0.1-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-bundler-4.0.3-33.3.hum1 (noarch)\n  * rubygem4.0-devel-4.0.3-33.3.hum1 (noarch)\n  * rubygem4.0-io-console-0.8.2-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-irb-1.16.0-33.3.hum1 (noarch)\n  * rubygem4.0-json-2.18.0-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-minitest-6.0.0-33.3.hum1 (noarch)\n  * rubygem4.0-power_assert-3.0.1-33.3.hum1 (noarch)\n  * rubygem4.0-psych-5.3.1-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-racc-1.8.1-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-rake-13.3.1-33.3.hum1 (noarch)\n  * rubygem4.0-rbs-3.10.0-33.3.hum1 (aarch64, x86_64)\n  * rubygem4.0-rdoc-7.0.3-33.3.hum1 (noarch)\n  * rubygem4.0-rexml-3.4.4-33.3.hum1 (noarch)\n  * rubygem4.0-rss-0.3.2-33.3.hum1 (noarch)\n  * rubygem4.0-rubygems-4.0.3-33.3.hum1 (noarch)\n  * rubygem4.0-test-unit-3.7.5-33.3.hum1 (noarch)\n  * rubygem4.0-typeprof-0.31.1-33.3.hum1 (noarch)\n  * ruby4.0-4.0.0-33.3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8838",
        "url": "https://access.redhat.com/errata/RHSA-2026:8838"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27820",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27820"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2008-3905",
        "url": "https://access.redhat.com/security/cve/CVE-2008-3905"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2008-3657",
        "url": "https://access.redhat.com/security/cve/CVE-2008-3657"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2008-3656",
        "url": "https://access.redhat.com/security/cve/CVE-2008-3656"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2008-3655",
        "url": "https://access.redhat.com/security/cve/CVE-2008-3655"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-27282",
        "url": "https://access.redhat.com/security/cve/CVE-2024-27282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2021-31810",
        "url": "https://access.redhat.com/security/cve/CVE-2021-31810"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2019-16254",
        "url": "https://access.redhat.com/security/cve/CVE-2019-16254"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2018-8780",
        "url": "https://access.redhat.com/security/cve/CVE-2018-8780"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2017-14064",
        "url": "https://access.redhat.com/security/cve/CVE-2017-14064"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2017-10784",
        "url": "https://access.redhat.com/security/cve/CVE-2017-10784"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2015-9096",
        "url": "https://access.redhat.com/security/cve/CVE-2015-9096"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2014-8090",
        "url": "https://access.redhat.com/security/cve/CVE-2014-8090"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2014-8080",
        "url": "https://access.redhat.com/security/cve/CVE-2014-8080"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2014-6438",
        "url": "https://access.redhat.com/security/cve/CVE-2014-6438"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2014-4975",
        "url": "https://access.redhat.com/security/cve/CVE-2014-4975"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2013-1821",
        "url": "https://access.redhat.com/security/cve/CVE-2013-1821"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2012-5371",
        "url": "https://access.redhat.com/security/cve/CVE-2012-5371"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2011-4815",
        "url": "https://access.redhat.com/security/cve/CVE-2011-4815"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2008-1891",
        "url": "https://access.redhat.com/security/cve/CVE-2008-1891"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-28756",
        "url": "https://access.redhat.com/security/cve/CVE-2023-28756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2022-28739",
        "url": "https://access.redhat.com/security/cve/CVE-2022-28739"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2021-41819",
        "url": "https://access.redhat.com/security/cve/CVE-2021-41819"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2021-28965",
        "url": "https://access.redhat.com/security/cve/CVE-2021-28965"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2020-25613",
        "url": "https://access.redhat.com/security/cve/CVE-2020-25613"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8838.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-04-21T13:32:51+00:00",
      "generator": {
        "date": "2026-04-21T13:32:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:8838",
      "initial_release_date": "2026-04-17T23:15:06+00:00",
      "revision_history": [
        {
          "date": "2026-04-17T23:15:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-21T02:52:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-21T13:32:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4-0-main@aarch64",
                "product": {
                  "name": "ruby4-0-main@aarch64",
                  "product_id": "ruby4-0-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby4.0@4.0.0-33.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4-0-main@src",
                "product": {
                  "name": "ruby4-0-main@src",
                  "product_id": "ruby4-0-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby4.0@4.0.0-33.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4-0-main@x86_64",
                "product": {
                  "name": "ruby4-0-main@x86_64",
                  "product_id": "ruby4-0-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby4.0@4.0.0-33.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4-0-main@noarch",
                "product": {
                  "name": "ruby4-0-main@noarch",
                  "product_id": "ruby4-0-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby4.0-default-gems@4.0.0-33.3.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4-0-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby4-0-main@aarch64"
        },
        "product_reference": "ruby4-0-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4-0-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby4-0-main@noarch"
        },
        "product_reference": "ruby4-0-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4-0-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby4-0-main@src"
        },
        "product_reference": "ruby4-0-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4-0-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby4-0-main@x86_64"
        },
        "product_reference": "ruby4-0-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-1891",
      "discovery_date": "2008-04-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "443829"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: WEBrick CGI source disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-1891\n\nThe risks associated with fixing this flaw outweigh the benefits of the fix. Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-1891"
        },
        {
          "category": "external",
          "summary": "RHBZ#443829",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=443829"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-1891",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-1891"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-1891",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1891"
        }
      ],
      "release_date": "2008-04-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: WEBrick CGI source disclosure"
    },
    {
      "cve": "CVE-2008-3655",
      "discovery_date": "2008-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "458948"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: multiple insufficient safe mode restrictions",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-3655"
        },
        {
          "category": "external",
          "summary": "RHBZ#458948",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=458948"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-3655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-3655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-3655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3655"
        }
      ],
      "release_date": "2008-08-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: multiple insufficient safe mode restrictions"
    },
    {
      "cve": "CVE-2008-3656",
      "discovery_date": "2008-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "458953"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: WEBrick DoS vulnerability (CPU consumption)",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-3656"
        },
        {
          "category": "external",
          "summary": "RHBZ#458953",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=458953"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-3656",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-3656"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-3656",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3656"
        }
      ],
      "release_date": "2008-08-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: WEBrick DoS vulnerability (CPU consumption)"
    },
    {
      "cve": "CVE-2008-3657",
      "discovery_date": "2008-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "458966"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check \"taintness\" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: missing \"taintness\" checks in dl module",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-3657"
        },
        {
          "category": "external",
          "summary": "RHBZ#458966",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=458966"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-3657",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-3657"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-3657",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3657"
        }
      ],
      "release_date": "2008-08-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: missing \"taintness\" checks in dl module"
    },
    {
      "cve": "CVE-2008-3905",
      "discovery_date": "2008-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "461495"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-3905"
        },
        {
          "category": "external",
          "summary": "RHBZ#461495",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=461495"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-3905",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-3905"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-3905",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3905"
        }
      ],
      "release_date": "2008-08-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "oCERT"
          ]
        }
      ],
      "cve": "CVE-2011-4815",
      "discovery_date": "2011-11-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "750564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: hash table collisions CPU usage DoS (oCERT-2011-003)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-4815"
        },
        {
          "category": "external",
          "summary": "RHBZ#750564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-4815",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-4815"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-4815",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4815"
        }
      ],
      "release_date": "2011-12-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: hash table collisions CPU usage DoS (oCERT-2011-003)"
    },
    {
      "cve": "CVE-2012-5371",
      "discovery_date": "2012-11-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "875236"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Not vulnerable. This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux 5 and 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5371"
        },
        {
          "category": "external",
          "summary": "RHBZ#875236",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=875236"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5371",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5371"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5371",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5371"
        }
      ],
      "release_date": "2012-11-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001)"
    },
    {
      "cve": "CVE-2013-1821",
      "discovery_date": "2013-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "914716"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: entity expansion DoS vulnerability in REXML",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-1821"
        },
        {
          "category": "external",
          "summary": "RHBZ#914716",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-1821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821"
        },
        {
          "category": "external",
          "summary": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/",
          "url": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/"
        }
      ],
      "release_date": "2013-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: entity expansion DoS vulnerability in REXML"
    },
    {
      "cve": "CVE-2014-4975",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2014-07-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1118158"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: off-by-one stack-based buffer overflow in the encodes() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux 5 and 6.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-4975"
        },
        {
          "category": "external",
          "summary": "RHBZ#1118158",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118158"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-4975",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-4975"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4975",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4975"
        }
      ],
      "release_date": "2014-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: off-by-one stack-based buffer overflow in the encodes() function"
    },
    {
      "cve": "CVE-2014-6438",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2015-07-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1490845"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Unsafe parsing of long strings via decode_www_form_component method",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-6438"
        },
        {
          "category": "external",
          "summary": "RHBZ#1490845",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1490845"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-6438",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-6438"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6438",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6438"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2014/08/19/ruby-1-9-2-p330-released/",
          "url": "https://www.ruby-lang.org/en/news/2014/08/19/ruby-1-9-2-p330-released/"
        }
      ],
      "release_date": "2014-08-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Unsafe parsing of long strings via decode_www_form_component method"
    },
    {
      "cve": "CVE-2014-8080",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2014-10-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1157709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: REXML billion laughs attack via parameter entity expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat JBoss SOA Platform 5 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes; and Red Hat JBoss SOA Platform 4.3 is now in Extended Life Support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-8080"
        },
        {
          "category": "external",
          "summary": "RHBZ#1157709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-8080",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-8080"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8080",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8080"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/",
          "url": "https://www.ruby-lang.org/en/news/2014/10/27/rexml-dos-cve-2014-8080/"
        }
      ],
      "release_date": "2014-10-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: REXML billion laughs attack via parameter entity expansion"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-8090",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2014-10-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1159927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: REXML incomplete fix for CVE-2014-8080",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat JBoss SOA Platform 5 is now in Maintenance Support phase receiving only qualified Important and Critical impact security fixes; and Red Hat JBoss SOA Platform 4.3 is now in Extended Life Support phase receiving only Critical impact security fixes. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware Product Life Cycle: https://access.redhat.com/support/policy/updates/jboss_notes/",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-8090"
        },
        {
          "category": "external",
          "summary": "RHBZ#1159927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1159927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-8090",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-8090"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-8090",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8090"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/",
          "url": "https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/"
        }
      ],
      "release_date": "2014-11-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: REXML incomplete fix for CVE-2014-8080"
    },
    {
      "cve": "CVE-2015-9096",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2017-06-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1461846"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A SMTP command injection flaw was found in the way Ruby\u0027s Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands in a SMTP session in order to facilitate phishing attacks or spam campaigns.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-9096"
        },
        {
          "category": "external",
          "summary": "RHBZ#1461846",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1461846"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9096",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-9096"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9096",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9096"
        }
      ],
      "release_date": "2017-06-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP"
    },
    {
      "cve": "CVE-2017-10784",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2017-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1492012"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that WEBrick did not sanitize all its log messages. If logs were printed in a terminal, an attacker could interact with the terminal via the use of escape sequences.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 5, 6, and 7, as well as the versions of rh-ruby22-ruby and  rh-ruby23-ruby as shipped with Red Hat Software Collections 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-10784"
        },
        {
          "category": "external",
          "summary": "RHBZ#1492012",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-10784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-10784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-10784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10784"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/",
          "url": "https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/"
        }
      ],
      "release_date": "2017-09-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick"
    },
    {
      "cve": "CVE-2017-14064",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2017-08-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1487552"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter\u0027s heap memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Arbitrary heap exposure during a JSON.generate call",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux 5, and 6. These versions do not include the JSON module.\n\nThis issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7, as well as the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-14064"
        },
        {
          "category": "external",
          "summary": "RHBZ#1487552",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1487552"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-14064",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-14064"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14064",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14064"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/",
          "url": "https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/"
        }
      ],
      "release_date": "2017-03-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: Arbitrary heap exposure during a JSON.generate call"
    },
    {
      "cve": "CVE-2018-8780",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2018-03-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1561949"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Unintentional directory traversal by poisoned NULL byte in Dir",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of ruby as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nThis issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-8780"
        },
        {
          "category": "external",
          "summary": "RHBZ#1561949",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1561949"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8780",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-8780"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8780",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8780"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/",
          "url": "https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/"
        }
      ],
      "release_date": "2018-03-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        },
        {
          "category": "workaround",
          "details": "It is possible to test for presence of the NULL byte manually prior to call a Dir method with an untrusted string.",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Unintentional directory traversal by poisoned NULL byte in Dir"
    },
    {
      "cve": "CVE-2019-16254",
      "cwe": {
        "id": "CWE-113",
        "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
      },
      "discovery_date": "2020-01-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1789556"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: HTTP response splitting in WEBrick",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-16254"
        },
        {
          "category": "external",
          "summary": "RHBZ#1789556",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789556"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-16254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-16254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16254"
        }
      ],
      "release_date": "2019-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ruby: HTTP response splitting in WEBrick"
    },
    {
      "cve": "CVE-2020-25613",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2020-09-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1883623"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Potential HTTP request smuggling in WEBrick",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25613"
        },
        {
          "category": "external",
          "summary": "RHBZ#1883623",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1883623"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25613",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25613"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25613"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/",
          "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/"
        }
      ],
      "release_date": "2020-09-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Potential HTTP request smuggling in WEBrick"
    },
    {
      "cve": "CVE-2021-28965",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2021-04-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1947526"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using REXML and writing parsed data back to a new XML document results in creating a document with a different structure. This issue could affect the integrity of processed data in applications using REXML that parse XML documents, write data back to XML, and re-parse them again.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: XML round-trip vulnerability in REXML",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-28965"
        },
        {
          "category": "external",
          "summary": "RHBZ#1947526",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1947526"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-28965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-28965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28965"
        }
      ],
      "release_date": "2021-04-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: XML round-trip vulnerability in REXML"
    },
    {
      "cve": "CVE-2021-31810",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-07-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1980126"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Ruby\u0027s Net::FTP module trusted the IP address included in the FTP server\u0027s response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from systems not accessible from the FTP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat CloudForms 5.11 does not ship Ruby or RubyGem net-ftp and thus not affected by the flaw. RubyGem net-sftp (Ruby implementation of Secure File Transfer Protocol) which product ship is different library component from the affected package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-31810"
        },
        {
          "category": "external",
          "summary": "RHBZ#1980126",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980126"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-31810",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-31810"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-31810",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31810"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/",
          "url": "https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/"
        }
      ],
      "release_date": "2021-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host"
    },
    {
      "cve": "CVE-2021-41819",
      "discovery_date": "2021-11-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2026757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Cookie prefix spoofing in CGI::Cookie.parse",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2026757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41819"
        }
      ],
      "release_date": "2021-11-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Cookie prefix spoofing in CGI::Cookie.parse"
    },
    {
      "cve": "CVE-2022-28739",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2022-04-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2075687"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Buffer overrun in String-to-Float conversion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-28739"
        },
        {
          "category": "external",
          "summary": "RHBZ#2075687",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2075687"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-28739",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-28739"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-28739",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28739"
        },
        {
          "category": "external",
          "summary": "http://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/",
          "url": "http://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/"
        }
      ],
      "release_date": "2022-04-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Buffer overrun in String-to-Float conversion"
    },
    {
      "cve": "CVE-2023-28756",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2023-04-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2184061"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Time gem and Time library of Ruby. The Time parser mishandles invalid strings with specific characters and causes an increase in execution time for parsing strings to Time objects. This issue may result in a Regular expression denial of service (ReDoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: ReDoS vulnerability in Time",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-28756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2184061",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184061"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-28756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-28756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-28756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28756"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/",
          "url": "https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/"
        }
      ],
      "release_date": "2023-03-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: ReDoS vulnerability in Time"
    },
    {
      "cve": "CVE-2024-27282",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-04-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2276810"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Ruby. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: Arbitrary memory address read vulnerability with Regex search",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The CVE-2024-27282 vulnerability in Ruby is classified as a Moderate severity issue due to its potential to expose arbitrary heap data relative to the start of the text through the Ruby regex compiler. While the vulnerability allows the extraction of pointers and sensitive strings from memory, its exploitation requires attacker-supplied data to be provided to the regex compiler. This means that an attacker would need to craft specific input to exploit the issue, limiting the ease of exploitation compared to vulnerabilities that might be remotely exploitable without user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-27282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2276810",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276810"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-27282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-27282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-27282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27282"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/",
          "url": "https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/"
        }
      ],
      "release_date": "2024-04-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: Arbitrary memory address read vulnerability with Regex search"
    },
    {
      "cve": "CVE-2026-27820",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-16T18:00:53.206650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2459002"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstream_buffer_ungets function does not ensure sufficient memory capacity before moving existing data, which can lead to memory corruption. An attacker could potentially exploit this to cause unexpected behavior or system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A buffer overflow vulnerability exists in the Zlib::GzipReader component of the Ruby zlib interface. This flaw, caused by insufficient memory capacity during data manipulation, could lead to memory corruption and system instability. This vulnerability is considered of a Moderate severity this happens because the high complexity to exploit, additionally the attacker may have not full control over the data is being corrupted or exfiltrated.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby4-0-main@aarch64",
          "Red Hat Hardened Images:ruby4-0-main@noarch",
          "Red Hat Hardened Images:ruby4-0-main@src",
          "Red Hat Hardened Images:ruby4-0-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2459002",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459002"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27820"
        },
        {
          "category": "external",
          "summary": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w",
          "url": "https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3467067",
          "url": "https://hackerone.com/reports/3467067"
        }
      ],
      "release_date": "2026-04-16T17:27:48.944000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-17T23:15:06+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8838"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby4-0-main@aarch64",
            "Red Hat Hardened Images:ruby4-0-main@noarch",
            "Red Hat Hardened Images:ruby4-0-main@src",
            "Red Hat Hardened Images:ruby4-0-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.