CVE-2011-2686
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for...
5.0 MediumFix available
CVE-2011-2686 is a medium vulnerability (CVSS 5.0) in Ruby-lang Ruby, published August 5, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.58%, the 85th percentile. Fixed in ruby1.8 1.8.7.302-2squeeze3.
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Exploit likelihood
2.58%Down 0.1 points since Feb 4, 2022
What each source reports
NVD Score used
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
- Record
CVE-2011-2686- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
- Record
CVE-2011-2686- Updated
- 2026-11-02
EUVDEUVD-2011-2668 No score
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
- Record
EUVD-2011-2668- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8g6-3p4h-6388 No score
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for...
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
- Record
GHSA-g8g6-3p4h-6388- Updated
- 2026-11-02
OSVBELL-CVE-2011-2686
CVE-2011-2686 does not affect BellSoft software
- Record
BELL-CVE-2011-2686- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:7305
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:7307
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:8838
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:8838- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruby1.8Debian:6.0 |
before 1.8.7.302-2squeeze3, plus listed versions 1.8.7.302-21.8.7.302-2squeeze11.8.7.302-2squeeze2 |
1.8.7.302-2squeeze3 |
ruby3.3Red Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-bundled-gemsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-default-gemsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-develRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-docRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-libsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.4Red Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-bundled-gemsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-default-gemsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby3.4-develRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-docRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-libsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby4.0Red Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-bundled-gemsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-default-gemsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-develRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-docRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-libsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2011/07/12/14
ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released
bugzilla.redhat.com/show_bug.cgi?id=722415
redmine.ruby-lang.org/issues/show/4338
svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
Show 171 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html
exchange.xforce.ibmcloud.com/vulnerabilities/69032
securityfocus.com/bid/49015
nvd.nist.gov/vuln/detail/CVE-2011-2686
github.com/advisories/GHSA-g8g6-3p4h-6388
docs.bell-sw.com/security/cves/CVE-2011-2686
access.redhat.com/errata/RHSA-2026:7305
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7305.json
cve.org/CVERecord?id=CVE-2008-1891
hackerone.com/reports/3467067