Every CVE Search/ Get API key

CVE-2026-42256

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

6.0 MediumFix available

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.30%Up 0.2 points since May 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42256
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1322, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-28925 6.0

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
EUVD-2026-28925
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-87pf-fpwv-p7m7 6.0

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Summary

When authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value.

Details

A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the SCRAM server-first-message, causing the client to perform an expensive OpenSSL::KDF.pbkdf2_hmac call. Because the PBKDF2 function is a blocking C extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby VM for the duration of the computation.

OpenSSL enforces an effective maximum by using a 32-bit signed integer for the iteration count, Depending on hardware capabilities and OpenSSL version, this iteration count may be sufficient for to block all Ruby threads in the process for over seven minutes.

This is listed as one of the "Security Considerations", in RFC 7804:

A hostile server can perform a computational denial-of-service attack on clients by sending a big iteration count value. In order to defend against that, a client implementation can pick a maximum iteration count that it is willing to use and reject any values that exceed that threshold (in such cases, the client, of course, has to fail the authentication).

Impact

During SCRAM authentication to a hostile server, the entire Ruby VM will be locked for the duration of the computation. Depending on hardware capabilities and OpenSSL version, this may take many minutes.

OpenSSL::KDF.pbkdf2_hmac is a blocking C function, so Timeout cannot be used to guard against this. And it retains the Global VM lock, so other ruby threads will also be unable to run.

Mitigation

  • Upgrade to a patched version of net-imap that adds the max_iterations option to the SASL-* authenticators, and call Net::IMAP#authenticate with a max_iterations keyword argument.

    NOTE: The default max_iterations is 2³¹ - 1, the maximum signed 32 bit integer, the maximum allowed by OpenSSL. To prevent a denial of service attack, this must be set to a safe value, depending on hardware and version of OpenSSL. It is the user's responsibility to enforce minimum and maximum iteration counts that are appropriate for their security context.

  • Alternatively, avoid SCRAM-* mechanisms when authenticating to untrusted servers.

Record
GHSA-87pf-fpwv-p7m7
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770, CWE-1322
Updated
2026-11-02
NVD 6.0

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42256
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-770, CWE-1322
Updated
2026-11-02
OSVALPINE-CVE-2026-42256 6.5

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
ALPINE-CVE-2026-42256
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-42256 6.5
Record
BELL-CVE-2026-42256
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 25 moreShow less
OSV 6.0

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
CVE-2026-42256
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1322, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42256 6.5

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
DEBIAN-CVE-2026-42256
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-07
OSVGHSA-87pf-fpwv-p7m7 6.0

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Summary

When authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value.

Details

A hostile IMAP server can send an arbitrarily large PBKDF2 iteration count in the SCRAM server-first-message, causing the client to perform an expensive OpenSSL::KDF.pbkdf2_hmac call. Because the PBKDF2 function is a blocking C extension and holds onto Ruby’s Global VM Lock, it can freeze the entire Ruby VM for the duration of the computation.

OpenSSL enforces an effective maximum by using a 32-bit signed integer for the iteration count, Depending on hardware capabilities and OpenSSL version, this iteration count may be sufficient for to block all Ruby threads in the process for over seven minutes.

This is listed as one of the "Security Considerations", in RFC 7804:

A hostile server can perform a computational denial-of-service attack on clients by sending a big iteration count value. In order to defend against that, a client implementation can pick a maximum iteration count that it is willing to use and reject any values that exceed that threshold (in such cases, the client, of course, has to fail the authentication).

Impact

During SCRAM authentication to a hostile server, the entire Ruby VM will be locked for the duration of the computation. Depending on hardware capabilities and OpenSSL version, this may take many minutes.

OpenSSL::KDF.pbkdf2_hmac is a blocking C function, so Timeout cannot be used to guard against this. And it retains the Global VM lock, so other ruby threads will also be unable to run.

Mitigation

  • Upgrade to a patched version of net-imap that adds the max_iterations option to the SASL-* authenticators, and call Net::IMAP#authenticate with a max_iterations keyword argument.

    NOTE: The default max_iterations is 2³¹ - 1, the maximum signed 32 bit integer, the maximum allowed by OpenSSL. To prevent a denial of service attack, this must be set to a safe value, depending on hardware and version of OpenSSL. It is the user's responsibility to enforce minimum and maximum iteration counts that are appropriate for their security context.

  • Alternatively, avoid SCRAM-* mechanisms when authenticating to untrusted servers.

Record
GHSA-87pf-fpwv-p7m7
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1322, CWE-770
Updated
2026-11-02
OSVRHSA-2026:33551 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:33551
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:33552 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:33552
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:33721 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:33721
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:38694 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:38694
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50728 7.3

Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

Record
RHSA-2026:50728
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50773 7.3

Red Hat Security Advisory: ruby4.0 security, bug fix, and enhancement update

Record
RHSA-2026:50773
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50778 7.3

Red Hat Security Advisory: ruby security, bug fix, and enhancement update

Record
RHSA-2026:50778
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50827 7.3

Red Hat Security Advisory: ruby:4.0 security, bug fix, and enhancement update

Record
RHSA-2026:50827
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:50828 7.3

Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

Record
RHSA-2026:50828
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50728 7.3

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50728
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50773 7.3

Important: ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-211310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50773
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50778 7.3

Important: ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-211300)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50778
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50827 7.3

Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9.8.z] (JIRA:Rocky Linux-211301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50827
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:50828 7.3

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9.8.z] (JIRA:Rocky Linux-171335)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:50828
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42256 6.0

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Record
UBUNTU-CVE-2026-42256
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:50728 No score

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50728
Updated
2026-11-02
OSVALSA-2026:50773 No score

Important: ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50773
Updated
2026-11-02
OSVALSA-2026:50778 No score

Important: ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50778
Updated
2026-11-02
OSVALSA-2026:50827 No score

Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [almalinux-9.8.z] (JIRA:AlmaLinux-211301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50827
Updated
2026-11-02
OSVALSA-2026:50828 No score

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
  • ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
  • net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
  • net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
  • net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

  • ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-9.8.z] (JIRA:AlmaLinux-171335)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:50828
Updated
2026-11-02
OSVopenSUSE-SU-2026:21225-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issue

Update to 3.0.0:

  • CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 (bsc#1265369).

Changes for rmt-server:

  • Version 3.0.0
  • Security fix: Remove unused ActionMailer/ActionMailbox components to eliminate CVE-2026-42256 (bsc#1265369)
  • Split Rails meta-gem into individual components for better security control
  • Version 2.26
  • Add support for processing, storing, and syncing system profiles (jsc#TEL-265)
  • Version 2.25
  • fix rmt-cli list and purge commands for large data (bsc#1253146 and bsc#1253147)
  • Fix mirroring of SLE16 NVIDIA-GPU-Compute-Toolkit-CUDA repo (bsc#1256826)
  • Support for new redirect_repo_hosts config, to exclude some repo hosts from mirroring, and send clients directly there (jsc#SCC-452)
  • rmt-server-pubcloud
  • Clearer error message (bsc#1256883)
  • Handle zypper response when data exporter raises an error (bsc#1257133)
  • Add Valkey + Sidekiq for async processing
  • Enable mirroring xz compressed repositories (bsc#1246976)
  • Rack 2.2.20 security update (bsc#1253953, bsc#1251937)
  • Drop some de-published products from RMT
  • Include Live-Patching for SLES 15.X (jsc#PCT-630)
  • Handle only one data exporter (bsc#1248869)
  • Do not decode instance data from db to access registry (bsc#1248510)
  • Handle instance verification exceptions
Record
openSUSE-SU-2026:21225-1
Updated
2026-11-02
OSVSUSE-SU-2026:3792-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issue:

Update to version 3.1 (bsc#1274715).

  • CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 (bsc#1265369).

Changes for rmt-server:

  • Version 3.1:
    • Remove all errors and warnings due to new Ruby and Ruby on Rails versions
  • Version 3.0:
    • Split Rails meta-gem into individual components for better security control
  • Version 3.0.alpha:
    • Update Ruby to version 3.4.8 and Rails to version 7.1.6
Record
SUSE-SU-2026:3792-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
net-imap
RubyGems
 0.6.0 to 0.6.3
0.6.4
net-imap
RubyGems
 0.5.0 to 0.5.13
0.5.14
net-imap
RubyGems
 0.4.0 to 0.4.23
0.4.24
ruby-net-imap
Alpine:v3.21
 before 0.4.25-r0
0.4.25-r0
ruby
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-bundled-gems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-default-gems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
ruby-libs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el8.10.0+4241+4264e34b
3.3.12-8.module_el8.10.0+4241+4264e34b
Show 290 moreShow less
Affected packages
PackageAffectedFixed
rubygem-abrt
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.4.0-1.module_el8.10.0+3799+191214cc
0.4.0-1.module_el8.10.0+3799+191214cc
rubygem-abrt-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.4.0-1.module_el8.10.0+3799+191214cc
0.4.0-1.module_el8.10.0+3799+191214cc
rubygem-bigdecimal
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.1.5-8.module_el8.10.0+4241+4264e34b
3.1.5-8.module_el8.10.0+4241+4264e34b
rubygem-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.5.22-8.module_el8.10.0+4241+4264e34b
2.5.22-8.module_el8.10.0+4241+4264e34b
rubygem-io-console
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.7.1-8.module_el8.10.0+4241+4264e34b
0.7.1-8.module_el8.10.0+4241+4264e34b
rubygem-irb
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.13.1-8.module_el8.10.0+4241+4264e34b
1.13.1-8.module_el8.10.0+4241+4264e34b
rubygem-json
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.7.2-8.module_el8.10.0+4241+4264e34b
2.7.2-8.module_el8.10.0+4241+4264e34b
rubygem-minitest
AlmaLinux:8
From an advisory covering 6 CVEs
 before 5.20.0-8.module_el8.10.0+4241+4264e34b
5.20.0-8.module_el8.10.0+4241+4264e34b
rubygem-mysql2
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.5.5-1.module_el8.10.0+3799+191214cc
0.5.5-1.module_el8.10.0+3799+191214cc
rubygem-mysql2-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.5.5-1.module_el8.10.0+3799+191214cc
0.5.5-1.module_el8.10.0+3799+191214cc
rubygem-pg
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.5.4-1.module_el8.10.0+3799+191214cc
1.5.4-1.module_el8.10.0+3799+191214cc
rubygem-pg-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.5.4-1.module_el8.10.0+3799+191214cc
1.5.4-1.module_el8.10.0+3799+191214cc
rubygem-power_assert
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.0.3-8.module_el8.10.0+4241+4264e34b
2.0.3-8.module_el8.10.0+4241+4264e34b
rubygem-psych
AlmaLinux:8
From an advisory covering 6 CVEs
 before 5.1.2-8.module_el8.10.0+4241+4264e34b
5.1.2-8.module_el8.10.0+4241+4264e34b
rubygem-racc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1.7.3-8.module_el8.10.0+4241+4264e34b
1.7.3-8.module_el8.10.0+4241+4264e34b
rubygem-rake
AlmaLinux:8
From an advisory covering 6 CVEs
 before 13.1.0-8.module_el8.10.0+4241+4264e34b
13.1.0-8.module_el8.10.0+4241+4264e34b
rubygem-rbs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.4.0-8.module_el8.10.0+4241+4264e34b
3.4.0-8.module_el8.10.0+4241+4264e34b
rubygem-rdoc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 6.6.3.1-8.module_el8.10.0+4241+4264e34b
6.6.3.1-8.module_el8.10.0+4241+4264e34b
rubygem-rexml
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.4.4-8.module_el8.10.0+4241+4264e34b
3.4.4-8.module_el8.10.0+4241+4264e34b
rubygem-rss
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.3.1-8.module_el8.10.0+4241+4264e34b
0.3.1-8.module_el8.10.0+4241+4264e34b
rubygem-test-unit
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.6.1-8.module_el8.10.0+4241+4264e34b
3.6.1-8.module_el8.10.0+4241+4264e34b
rubygem-typeprof
AlmaLinux:8
From an advisory covering 6 CVEs
 before 0.21.9-8.module_el8.10.0+4241+4264e34b
0.21.9-8.module_el8.10.0+4241+4264e34b
rubygems
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el8.10.0+4241+4264e34b
3.5.22-8.module_el8.10.0+4241+4264e34b
rubygems-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el8.10.0+4241+4264e34b
3.5.22-8.module_el8.10.0+4241+4264e34b
ruby4.0
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-doc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 4.0.6-36.el10_2
4.0.6-36.el10_2
ruby4.0-rubygem-mysql2
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.5.7-36.el10_2
0.5.7-36.el10_2
ruby4.0-rubygem-pg
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.6.3-36.el10_2
1.6.3-36.el10_2
ruby
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-bundled-gems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-default-gems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-doc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
ruby-libs
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.3.12-14.el10_2
3.3.12-14.el10_2
rubygem-bigdecimal
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.1.5-14.el10_2
3.1.5-14.el10_2
rubygem-bundler
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.5.22-14.el10_2
2.5.22-14.el10_2
rubygem-io-console
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.7.1-14.el10_2
0.7.1-14.el10_2
rubygem-irb
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.13.1-14.el10_2
1.13.1-14.el10_2
rubygem-json
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.7.2-14.el10_2
2.7.2-14.el10_2
rubygem-minitest
AlmaLinux:10
From an advisory covering 6 CVEs
 before 5.20.0-14.el10_2
5.20.0-14.el10_2
rubygem-power_assert
AlmaLinux:10
From an advisory covering 6 CVEs
 before 2.0.3-14.el10_2
2.0.3-14.el10_2
rubygem-psych
AlmaLinux:10
From an advisory covering 6 CVEs
 before 5.1.2-14.el10_2
5.1.2-14.el10_2
rubygem-racc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 1.7.3-14.el10_2
1.7.3-14.el10_2
rubygem-rake
AlmaLinux:10
From an advisory covering 6 CVEs
 before 13.1.0-14.el10_2
13.1.0-14.el10_2
rubygem-rbs
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.4.0-14.el10_2
3.4.0-14.el10_2
rubygem-rdoc
AlmaLinux:10
From an advisory covering 6 CVEs
 before 6.6.3.1-14.el10_2
6.6.3.1-14.el10_2
rubygem-rexml
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.4.4-14.el10_2
3.4.4-14.el10_2
rubygem-rss
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.3.1-14.el10_2
0.3.1-14.el10_2
rubygem-test-unit
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.6.1-14.el10_2
3.6.1-14.el10_2
rubygem-typeprof
AlmaLinux:10
From an advisory covering 6 CVEs
 before 0.21.9-14.el10_2
0.21.9-14.el10_2
rubygems
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.5.22-14.el10_2
3.5.22-14.el10_2
rubygems-devel
AlmaLinux:10
From an advisory covering 6 CVEs
 before 3.5.22-14.el10_2
3.5.22-14.el10_2
ruby
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-bundled-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-default-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
ruby-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.6-34.module_el9.8.0+289+5a070f48
4.0.6-34.module_el9.8.0+289+5a070f48
rubygem-bigdecimal
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.1-34.module_el9.8.0+289+5a070f48
4.0.1-34.module_el9.8.0+289+5a070f48
rubygem-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
rubygem-io-console
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.8.2-34.module_el9.8.0+289+5a070f48
0.8.2-34.module_el9.8.0+289+5a070f48
rubygem-irb
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.16.0-34.module_el9.8.0+289+5a070f48
1.16.0-34.module_el9.8.0+289+5a070f48
rubygem-json
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.18.0-34.module_el9.8.0+289+5a070f48
2.18.0-34.module_el9.8.0+289+5a070f48
rubygem-minitest
AlmaLinux:9
From an advisory covering 6 CVEs
 before 6.0.0-34.module_el9.8.0+289+5a070f48
6.0.0-34.module_el9.8.0+289+5a070f48
rubygem-mysql2
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-mysql2-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-pg
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-pg-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-power_assert
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.0.1-34.module_el9.8.0+289+5a070f48
3.0.1-34.module_el9.8.0+289+5a070f48
rubygem-psych
AlmaLinux:9
From an advisory covering 6 CVEs
 before 5.3.1-34.module_el9.8.0+289+5a070f48
5.3.1-34.module_el9.8.0+289+5a070f48
rubygem-racc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.8.1-34.module_el9.8.0+289+5a070f48
1.8.1-34.module_el9.8.0+289+5a070f48
rubygem-rake
AlmaLinux:9
From an advisory covering 6 CVEs
 before 13.3.1-34.module_el9.8.0+289+5a070f48
13.3.1-34.module_el9.8.0+289+5a070f48
rubygem-rbs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.10.0-34.module_el9.8.0+289+5a070f48
3.10.0-34.module_el9.8.0+289+5a070f48
rubygem-rdoc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 7.0.4-34.module_el9.8.0+289+5a070f48
7.0.4-34.module_el9.8.0+289+5a070f48
rubygem-rexml
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.4.4-34.module_el9.8.0+289+5a070f48
3.4.4-34.module_el9.8.0+289+5a070f48
rubygem-rss
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.3.2-34.module_el9.8.0+289+5a070f48
0.3.2-34.module_el9.8.0+289+5a070f48
rubygem-test-unit
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.7.5-34.module_el9.8.0+289+5a070f48
3.7.5-34.module_el9.8.0+289+5a070f48
rubygem-typeprof
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.31.1-34.module_el9.8.0+289+5a070f48
0.31.1-34.module_el9.8.0+289+5a070f48
rubygems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
rubygems-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 4.0.16-34.module_el9.8.0+289+5a070f48
4.0.16-34.module_el9.8.0+289+5a070f48
ruby
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-bundled-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-default-gems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
ruby-libs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.3.12-8.module_el9.8.0+288+22f1c9f2
3.3.12-8.module_el9.8.0+288+22f1c9f2
rubygem-bigdecimal
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.1.5-8.module_el9.8.0+288+22f1c9f2
3.1.5-8.module_el9.8.0+288+22f1c9f2
rubygem-bundler
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.5.22-8.module_el9.8.0+288+22f1c9f2
2.5.22-8.module_el9.8.0+288+22f1c9f2
rubygem-io-console
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.7.1-8.module_el9.8.0+288+22f1c9f2
0.7.1-8.module_el9.8.0+288+22f1c9f2
rubygem-irb
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.13.1-8.module_el9.8.0+288+22f1c9f2
1.13.1-8.module_el9.8.0+288+22f1c9f2
rubygem-json
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.7.2-8.module_el9.8.0+288+22f1c9f2
2.7.2-8.module_el9.8.0+288+22f1c9f2
rubygem-minitest
AlmaLinux:9
From an advisory covering 6 CVEs
 before 5.20.0-8.module_el9.8.0+288+22f1c9f2
5.20.0-8.module_el9.8.0+288+22f1c9f2
rubygem-mysql2
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-mysql2-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.5.5-3.module_el9.7.0+184+e2e36072
0.5.5-3.module_el9.7.0+184+e2e36072
rubygem-pg
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
rubygem-pg-doc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.5.4-2.module_el9.7.0+245+447713a2
1.5.4-2.module_el9.7.0+245+447713a2
rubygem-power_assert
AlmaLinux:9
From an advisory covering 6 CVEs
 before 2.0.3-8.module_el9.8.0+288+22f1c9f2
2.0.3-8.module_el9.8.0+288+22f1c9f2
rubygem-psych
AlmaLinux:9
From an advisory covering 6 CVEs
 before 5.1.2-8.module_el9.8.0+288+22f1c9f2
5.1.2-8.module_el9.8.0+288+22f1c9f2
rubygem-racc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 1.7.3-8.module_el9.8.0+288+22f1c9f2
1.7.3-8.module_el9.8.0+288+22f1c9f2
rubygem-rake
AlmaLinux:9
From an advisory covering 6 CVEs
 before 13.1.0-8.module_el9.8.0+288+22f1c9f2
13.1.0-8.module_el9.8.0+288+22f1c9f2
rubygem-rbs
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.4.0-8.module_el9.8.0+288+22f1c9f2
3.4.0-8.module_el9.8.0+288+22f1c9f2
rubygem-rdoc
AlmaLinux:9
From an advisory covering 6 CVEs
 before 6.6.3.1-8.module_el9.8.0+288+22f1c9f2
6.6.3.1-8.module_el9.8.0+288+22f1c9f2
rubygem-rexml
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.4.4-8.module_el9.8.0+288+22f1c9f2
3.4.4-8.module_el9.8.0+288+22f1c9f2
rubygem-rss
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.3.1-8.module_el9.8.0+288+22f1c9f2
0.3.1-8.module_el9.8.0+288+22f1c9f2
rubygem-test-unit
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.6.1-8.module_el9.8.0+288+22f1c9f2
3.6.1-8.module_el9.8.0+288+22f1c9f2
rubygem-typeprof
AlmaLinux:9
From an advisory covering 6 CVEs
 before 0.21.9-8.module_el9.8.0+288+22f1c9f2
0.21.9-8.module_el9.8.0+288+22f1c9f2
rubygems
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el9.8.0+288+22f1c9f2
3.5.22-8.module_el9.8.0+288+22f1c9f2
rubygems-devel
AlmaLinux:9
From an advisory covering 6 CVEs
 before 3.5.22-8.module_el9.8.0+288+22f1c9f2
3.5.22-8.module_el9.8.0+288+22f1c9f2
ruby-net-imap
Alpaquita:25
 0.5.8-r0 up to 0.5.14-r0
0.5.14-r0
ruby-net-imap
Alpaquita:stream
 0.4.8-r0 up to 0.5.14-r0
0.5.14-r0
ruby3.1
Debian:12
 All versions, plus listed versions
3.1.2-73.1.2-7+deb12u13.1.2-7+hurd.13.1.2-83.1.2-8.1~exp13.1.2-8.33.1.2-8.43.1.2-8.5
 None known
ruby3.3
Debian:13
 before 3.3.13-0+deb13u1, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
3.3.13-0+deb13u1
ruby3.3
Debian:14
 All versions, plus listed versions
3.3.8-23.3.8-2.13.3.8-2.2
 None known
net-imap
RubyGems
 0.6.0 up to 0.6.4, plus listed versions
0.6.10.6.20.6.3
0.6.4
net-imap
RubyGems
 0.5.0 up to 0.5.14, plus listed versions
0.5.10.5.100.5.110.5.120.5.13
Show 8 moreShow less
0.5.20.5.30.5.40.5.50.5.60.5.70.5.80.5.9
0.5.14
net-imap
RubyGems
 0.4.0 up to 0.4.24, plus listed versions
0.4.10.4.100.4.110.4.120.4.13
Show 19 moreShow less
0.4.140.4.150.4.160.4.170.4.180.4.190.4.20.4.200.4.210.4.220.4.230.4.30.4.40.4.50.4.60.4.70.4.80.4.90.4.9.1
0.4.24
ruby4.0
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
ruby4.0-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
ruby4.0-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
ruby4.0-libs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.0-33.4.hum1
0:4.0.0-33.4.hum1
rubygem4.0-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.1-33.4.hum1
0:4.0.1-33.4.hum1
rubygem4.0-bundler
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.3-33.4.hum1
0:4.0.3-33.4.hum1
rubygem4.0-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.3-33.4.hum1
0:4.0.3-33.4.hum1
rubygem4.0-io-console
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.8.2-33.4.hum1
0:0.8.2-33.4.hum1
rubygem4.0-irb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.16.0-33.4.hum1
0:1.16.0-33.4.hum1
rubygem4.0-json
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.18.0-33.4.hum1
0:2.18.0-33.4.hum1
rubygem4.0-minitest
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:6.0.0-33.4.hum1
0:6.0.0-33.4.hum1
rubygem4.0-power_assert
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.0.1-33.4.hum1
0:3.0.1-33.4.hum1
rubygem4.0-psych
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:5.3.1-33.4.hum1
0:5.3.1-33.4.hum1
rubygem4.0-racc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.8.1-33.4.hum1
0:1.8.1-33.4.hum1
rubygem4.0-rake
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:13.3.1-33.4.hum1
0:13.3.1-33.4.hum1
rubygem4.0-rbs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.10.0-33.4.hum1
0:3.10.0-33.4.hum1
rubygem4.0-rdoc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:7.0.3-33.4.hum1
0:7.0.3-33.4.hum1
rubygem4.0-rexml
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.4-33.4.hum1
0:3.4.4-33.4.hum1
rubygem4.0-rss
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.3.2-33.4.hum1
0:0.3.2-33.4.hum1
rubygem4.0-rubygems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:4.0.3-33.4.hum1
0:4.0.3-33.4.hum1
rubygem4.0-test-unit
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.7.5-33.4.hum1
0:3.7.5-33.4.hum1
rubygem4.0-typeprof
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.31.1-33.4.hum1
0:0.31.1-33.4.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.8-31.2.hum1
0:3.4.8-31.2.hum1
rubygem3.4-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.1.8-31.2.hum1
0:3.1.8-31.2.hum1
rubygem3.4-bundler
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.6.9-31.2.hum1
0:2.6.9-31.2.hum1
rubygem3.4-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.6.9-31.2.hum1
0:3.6.9-31.2.hum1
rubygem3.4-io-console
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.8.1-31.2.hum1
0:0.8.1-31.2.hum1
rubygem3.4-irb
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:1.14.3-31.2.hum1
0:1.14.3-31.2.hum1
rubygem3.4-json
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.9.1-31.2.hum1
0:2.9.1-31.2.hum1
rubygem3.4-minitest
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:5.25.4-31.2.hum1
0:5.25.4-31.2.hum1
rubygem3.4-power_assert
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.0.5-31.2.hum1
0:2.0.5-31.2.hum1
rubygem3.4-psych
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:5.2.2-31.2.hum1
0:5.2.2-31.2.hum1
rubygem3.4-racc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:1.8.1-31.2.hum1
0:1.8.1-31.2.hum1
rubygem3.4-rake
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:13.2.1-31.2.hum1
0:13.2.1-31.2.hum1
rubygem3.4-rbs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.8.0-31.2.hum1
0:3.8.0-31.2.hum1
rubygem3.4-rdoc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.14.0-31.2.hum1
0:6.14.0-31.2.hum1
rubygem3.4-rexml
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.4-31.2.hum1
0:3.4.4-31.2.hum1
rubygem3.4-rss
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.3.1-31.2.hum1
0:0.3.1-31.2.hum1
rubygem3.4-rubygems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.6.9-31.2.hum1
0:3.6.9-31.2.hum1
rubygem3.4-test-unit
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.6.7-31.2.hum1
0:3.6.7-31.2.hum1
rubygem3.4-typeprof
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.30.1-31.2.hum1
0:0.30.1-31.2.hum1
ruby3.3
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
ruby3.3-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
ruby3.3-default-gems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
ruby3.3-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
ruby3.3-doc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
ruby3.3-libs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.3.10-23.2.hum1
0:3.3.10-23.2.hum1
rubygem3.3-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.1.5-23.2.hum1
0:3.1.5-23.2.hum1
rubygem3.3-bundler
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.5.22-23.2.hum1
0:2.5.22-23.2.hum1
rubygem3.3-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.5.22-23.2.hum1
0:3.5.22-23.2.hum1
rubygem3.3-io-console
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.7.1-23.2.hum1
0:0.7.1-23.2.hum1
rubygem3.3-irb
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:1.13.1-23.2.hum1
0:1.13.1-23.2.hum1
rubygem3.3-json
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.7.2-23.2.hum1
0:2.7.2-23.2.hum1
rubygem3.3-minitest
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:5.20.0-23.2.hum1
0:5.20.0-23.2.hum1
rubygem3.3-power_assert
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.0.3-23.2.hum1
0:2.0.3-23.2.hum1
rubygem3.3-psych
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:5.1.2-23.2.hum1
0:5.1.2-23.2.hum1
rubygem3.3-racc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:1.7.3-23.2.hum1
0:1.7.3-23.2.hum1
rubygem3.3-rake
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:13.1.0-23.2.hum1
0:13.1.0-23.2.hum1
rubygem3.3-rbs
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.0-23.2.hum1
0:3.4.0-23.2.hum1
rubygem3.3-rdoc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:6.6.3.1-23.2.hum1
0:6.6.3.1-23.2.hum1
rubygem3.3-rexml
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.4.4-23.2.hum1
0:3.4.4-23.2.hum1
rubygem3.3-rss
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.3.1-23.2.hum1
0:0.3.1-23.2.hum1
rubygem3.3-rubygems
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.5.22-23.2.hum1
0:3.5.22-23.2.hum1
rubygem3.3-test-unit
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:3.6.1-23.2.hum1
0:3.6.1-23.2.hum1
rubygem3.3-typeprof
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.21.9-23.2.hum1
0:0.21.9-23.2.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.10-31.hum1
0:3.4.10-31.hum1
rubygem3.4-bigdecimal
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.1.8-31.hum1
0:3.1.8-31.hum1
rubygem3.4-bundler
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.6.9-31.hum1
0:2.6.9-31.hum1
rubygem3.4-devel
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.9-31.hum1
0:3.6.9-31.hum1
rubygem3.4-io-console
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.8.1-31.hum1
0:0.8.1-31.hum1
rubygem3.4-irb
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.14.3-31.hum1
0:1.14.3-31.hum1
rubygem3.4-json
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.9.1-31.hum1
0:2.9.1-31.hum1
rubygem3.4-minitest
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:5.25.4-31.hum1
0:5.25.4-31.hum1
rubygem3.4-power_assert
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:2.0.5-31.hum1
0:2.0.5-31.hum1
rubygem3.4-psych
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:5.2.2-31.hum1
0:5.2.2-31.hum1
rubygem3.4-racc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:1.8.1-31.hum1
0:1.8.1-31.hum1
rubygem3.4-rake
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:13.2.1-31.hum1
0:13.2.1-31.hum1
rubygem3.4-rbs
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.8.0-31.hum1
0:3.8.0-31.hum1
rubygem3.4-rdoc
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:6.14.0-31.hum1
0:6.14.0-31.hum1
rubygem3.4-rexml
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.4.4-31.hum1
0:3.4.4-31.hum1
rubygem3.4-rss
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.3.1-31.hum1
0:0.3.1-31.hum1
rubygem3.4-rubygems
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.9-31.hum1
0:3.6.9-31.hum1
rubygem3.4-test-unit
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:3.6.7-31.hum1
0:3.6.7-31.hum1
rubygem3.4-typeprof
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:0.30.1-31.hum1
0:0.30.1-31.hum1
ruby
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-bundled-gems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-bundled-gems-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-default-gems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-libs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
ruby-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+24567+c4e5368e
0:3.3.12-8.module+el8.10.0+24567+c4e5368e
rubygem-abrt
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-abrt-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-bigdecimal
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.5-8.module+el8.10.0+24567+c4e5368e
0:3.1.5-8.module+el8.10.0+24567+c4e5368e
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.1.5-8.module+el8.10.0+24567+c4e5368e
0:3.1.5-8.module+el8.10.0+24567+c4e5368e
rubygem-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.5.22-8.module+el8.10.0+24567+c4e5368e
0:2.5.22-8.module+el8.10.0+24567+c4e5368e
rubygem-io-console
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.7.1-8.module+el8.10.0+24567+c4e5368e
0:0.7.1-8.module+el8.10.0+24567+c4e5368e
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.7.1-8.module+el8.10.0+24567+c4e5368e
0:0.7.1-8.module+el8.10.0+24567+c4e5368e
rubygem-irb
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.13.1-8.module+el8.10.0+24567+c4e5368e
0:1.13.1-8.module+el8.10.0+24567+c4e5368e
rubygem-json
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.7.2-8.module+el8.10.0+24567+c4e5368e
0:2.7.2-8.module+el8.10.0+24567+c4e5368e
rubygem-json-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.7.2-8.module+el8.10.0+24567+c4e5368e
0:2.7.2-8.module+el8.10.0+24567+c4e5368e
rubygem-minitest
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.20.0-8.module+el8.10.0+24567+c4e5368e
0:5.20.0-8.module+el8.10.0+24567+c4e5368e
rubygem-mysql2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-mysql2-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+21226+b78a28c4
0:0.5.5-1.module+el8.10.0+21226+b78a28c4
rubygem-pg
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-pg-doc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+21226+b78a28c4
0:1.5.4-1.module+el8.10.0+21226+b78a28c4
rubygem-power_assert
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.0.3-8.module+el8.10.0+24567+c4e5368e
0:2.0.3-8.module+el8.10.0+24567+c4e5368e
rubygem-psych
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.1.2-8.module+el8.10.0+24567+c4e5368e
0:5.1.2-8.module+el8.10.0+24567+c4e5368e
rubygem-psych-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:5.1.2-8.module+el8.10.0+24567+c4e5368e
0:5.1.2-8.module+el8.10.0+24567+c4e5368e
rubygem-racc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.7.3-8.module+el8.10.0+24567+c4e5368e
0:1.7.3-8.module+el8.10.0+24567+c4e5368e
rubygem-racc-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:1.7.3-8.module+el8.10.0+24567+c4e5368e
0:1.7.3-8.module+el8.10.0+24567+c4e5368e
rubygem-rake
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:13.1.0-8.module+el8.10.0+24567+c4e5368e
0:13.1.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rbs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.0-8.module+el8.10.0+24567+c4e5368e
0:3.4.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rbs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.0-8.module+el8.10.0+24567+c4e5368e
0:3.4.0-8.module+el8.10.0+24567+c4e5368e
rubygem-rdoc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:6.6.3.1-8.module+el8.10.0+24567+c4e5368e
0:6.6.3.1-8.module+el8.10.0+24567+c4e5368e
rubygem-rexml
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.4.4-8.module+el8.10.0+24567+c4e5368e
0:3.4.4-8.module+el8.10.0+24567+c4e5368e
rubygem-rss
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.3.1-8.module+el8.10.0+24567+c4e5368e
0:0.3.1-8.module+el8.10.0+24567+c4e5368e
rubygem-test-unit
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.6.1-8.module+el8.10.0+24567+c4e5368e
0:3.6.1-8.module+el8.10.0+24567+c4e5368e
rubygem-typeprof
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:0.21.9-8.module+el8.10.0+24567+c4e5368e
0:0.21.9-8.module+el8.10.0+24567+c4e5368e
rubygems
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.5.22-8.module+el8.10.0+24567+c4e5368e
0:3.5.22-8.module+el8.10.0+24567+c4e5368e
rubygems-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.5.22-8.module+el8.10.0+24567+c4e5368e
0:3.5.22-8.module+el8.10.0+24567+c4e5368e
ruby4.0
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby4.0-rubygem-mysql2
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:0.5.7-36.el10_2
0:0.5.7-36.el10_2
ruby4.0-rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 6 CVEs
 before 0:0.5.7-36.el10_2
0:0.5.7-36.el10_2
ruby
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el8.10.0+40269+dc93e2d1
0:3.3.12-8.module+el8.10.0+40269+dc93e2d1
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1679+61871737
0:0.4.0-1.module+el8.10.0+1679+61871737
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.5.0+668+665814fa
0:0.4.0-1.module+el8.5.0+668+665814fa
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.9.0+1537+0b2034bd
0:0.4.0-1.module+el8.9.0+1537+0b2034bd
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1820+f3fffb92
0:0.4.0-1.module+el8.10.0+1820+f3fffb92
rubygem-abrt
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.4.0-1.module+el8.10.0+1826+b62220b4
0:0.4.0-1.module+el8.10.0+1826+b62220b4
rubygem-mysql2
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+1679+61871737
0:0.5.5-1.module+el8.10.0+1679+61871737
rubygem-mysql2
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
rubygem-pg
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+1679+61871737
0:1.5.4-1.module+el8.10.0+1679+61871737
rubygem-pg
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
0:1.5.4-1.module+el8.10.0+1827+16ecb9d2
ruby4.0
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:4.0.6-36.el10_2
0:4.0.6-36.el10_2
ruby
Rocky Linux:10
From an advisory covering 6 CVEs
 before 0:3.3.12-14.el10_2
0:3.3.12-14.el10_2
ruby
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:4.0.6-34.module+el9.8.0+40271+b5850c84
0:4.0.6-34.module+el9.8.0+40271+b5850c84
rubygem-mysql2
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:0.5.7-1.module+el9.8.0+40094+ce01217c
0:0.5.7-1.module+el9.8.0+40094+ce01217c
rubygem-pg
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:1.6.3-1.module+el9.8.0+40094+ce01217c
0:1.6.3-1.module+el9.8.0+40094+ce01217c
ruby
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:3.3.12-8.module+el9.8.0+40270+7a73441e
0:3.3.12-8.module+el9.8.0+40270+7a73441e
rubygem-mysql2
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:0.5.5-3.module+el9.7.0+40032+36e56d0d
0:0.5.5-3.module+el9.7.0+40032+36e56d0d
rubygem-pg
Rocky Linux:9
From an advisory covering 6 CVEs
 before 0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1
0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1
rmt-server
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 3.1.0-150700.3.28.1
3.1.0-150700.3.28.1
rmt-server
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 3.1.0-150700.3.28.1
3.1.0-150700.3.28.1
jruby
Ubuntu:25.10
 All versions, plus listed versions
9.4.8.0+ds-2ubuntu19.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:25.10
 All versions, plus listed versions
3.3.7-1ubuntu23.3.8-2ubuntu13.3.8-2ubuntu23.3.8-2ubuntu2.1
 None known
jruby
Ubuntu:26.10
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu19.4.14.0+ds-1
 None known
ruby3.3
Ubuntu:26.04:LTS
 before 3.3.8-2ubuntu3.1, plus listed versions
3.3.8-2ubuntu23.3.8-2ubuntu3
3.3.8-2ubuntu3.1
rmt-server
openSUSE:Leap 16.0
 before 3.0.0-160000.1.1
3.0.0-160000.1.1

History

History
RecordedChangedSources
affectedOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42256 is a medium vulnerability (CVSS 6.0) in Ruby Net-imap, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in net-imap 0.6.4.

References

Show 114 moreShow less
This page doesn't list everything

Left out here: 121 package rows. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open