Ruby vulnerabilities

Products

• Net-imap 10
• Rexml 7
• Zlib 6
• Json 5
• Ruby 5
• Resolv 3
• Uri 3
• Nokogiri Gem 2

Newest

• ruby zlib zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate CVE-2026-85091 Fix available 8.3 HighSeptember 3, 2026
• ruby zlib zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write CVE-2026-76844 Fix available 8.3 HighAugust 24, 2026
• ruby resolv An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder... CVE-2026-80213 Fix available 4.0 MediumAugust 21, 2026
• ruby resolv An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,... CVE-2026-80212 Fix available 7.5 HighAugust 21, 2026
• ruby json Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams CVE-2026-71847 Fix available 8.7 HighAugust 7, 2026
• ruby json Ruby JSON: JSON generator heap buffer overflow when streaming to an IO CVE-2026-54696 Fix available 3.7 LowJune 30, 2026
• ruby net-imap Net::IMAP: Command Injection via ID command argument CVE-2026-47242 Fix available 5.8 MediumJune 9, 2026
• ruby net-imap Net::IMAP: Denial of Service via incomplete raw argument validation CVE-2026-47241 Fix available 2.1 LowJune 9, 2026
• ruby net-imap Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument CVE-2026-47240 Fix available 5.8 MediumJune 9, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Command Injection via "raw" arguments to multiple commands CVE-2026-42257 Fix available 5.8 MediumMay 4, 2026
• ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +19 more +21 more net-imap: Command Injection via unvalidated Symbol inputs CVE-2026-42258 Fix available 5.8 MediumMay 4, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Denial of service via high iteration count for `SCRAM-*` authentication CVE-2026-42256 Fix available 6.0 MediumMay 4, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Quadratic complexity when reading response literals CVE-2026-42245 Fix available 2.3 LowMay 4, 2026
• ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 more ERB has an @_init deserialization guard bypass via def_module / def_method / def_class CVE-2026-41316 Fix available 8.1 HighApril 23, 2026
• ruby zlib zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption CVE-2026-27820 Fix available 1.7 LowMarch 20, 2026
• ruby json, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +6 more +8 more Ruby JSON has a format string injection vulnerability CVE-2026-33210 Fix available 8.3 HighMarch 19, 2026
• ruby zlib zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because... CVE-2026-27171 Fix available 2.9 LowFebruary 18, 2026
• ruby zlib, red hat logging subsystem for red hat openshift, build of openjdk 1.8 +14 more +16 more zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname() CVE-2026-22184 Fix availableDisputed 4.6 MediumJanuary 7, 2026
• ruby uri URI Credential Leakage Bypass over CVE-2025-27221 CVE-2025-61594 Fix available 2.1 LowOctober 8, 2025
• ruby rexml REXML has a DoS condition when parsing malformed XML file CVE-2025-58767 Fix available 1.2 LowSeptember 17, 2025
• ruby resolv resolv vulnerable to DoS via insufficient DNS domain name length validation CVE-2025-24294 Fix available 7.5 HighJuly 12, 2025
• ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +17 more +19 more net-imap vulnerable to STARTTLS stripping via invalid response timing CVE-2026-42246 Fix available 7.6 HighJune 29, 2025
• ruby webrick Ruby WEBrick read_header HTTP Request Smuggling Vulnerability CVE-2025-6442 Fix available 6.5 MediumJune 25, 2025
• ruby net-imap, ruby-lang net\ +1 more net-imap rubygem vulnerable to possible DoS by memory exhaustion CVE-2025-43857 Fix available 6.0 MediumApril 28, 2025
• ruby json, ruby-lang javascript object notation +1 more Ruby JSON Parser has Out-of-bounds Read CVE-2025-27788 Fix available 7.5 HighMarch 12, 2025
• ruby uri URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ CVE-2025-27221 Fix available 3.2 LowMarch 3, 2025
• ruby net-imap Net::IMAP vulnerable to possible DoS by memory exhaustion CVE-2025-25186 Fix available 6.5 MediumFebruary 10, 2025
• ruby rexml, netapp ontap tools +1 more REXML ReDoS vulnerability CVE-2024-49761 Fix available 6.6 MediumOctober 28, 2024
• ruby rexml, netapp bootstrap os +1 more REXML denial of service vulnerability CVE-2024-43398 Fix available 5.9 MediumAugust 22, 2024
• ruby rexml REXML DoS vulnerability CVE-2024-41946 Fix available 5.3 MediumAugust 1, 2024
• ruby rexml REXML DoS vulnerability CVE-2024-41123 Fix available 5.3 MediumAugust 1, 2024
• ruby rexml, netapp bootstrap os +1 more Denial of service in REXML CVE-2024-39908 Public exploitFix available 4.3 MediumJuly 16, 2024
• ruby rexml REXML contains a denial of service vulnerability CVE-2024-35176 Public exploitFix available 5.3 MediumMay 16, 2024
• phlex-ruby phlex, ruby fileutils +1 more phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags CVE-2024-32463 Fix available 7.1 HighApril 17, 2024
• ruby rdoc RDoc RCE vulnerability with .rdoc_options CVE-2024-27281 Fix available 4.5 MediumMarch 25, 2024
• cloudflare zlib Memory corruption issues is Cloudflare zlib implementation CVE-2023-6992 Fix available 4.0 MediumJanuary 4, 2024
• lambdaisland uri `authority-regex` returns the wrong authority in lambdaisland/uri CVE-2023-28628 Fix available 5.4 MediumMarch 27, 2023
• joyent json, oracle commerce guided search, financial services crime and compliance management studio +2 more +4 more Command Injection CVE-2020-7712 Fix available 7.2 HighAugust 30, 2020
• hackerone ruby Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X... CVE-2011-3624 5.3 MediumNovember 26, 2019
• nokogiri, ruby nokogiri gem, debian linux +5 more +7 more Nokogiri vulnerable to DoS while parsing XML entities CVE-2013-6461 Fix available 6.5 MediumNovember 5, 2019
• nokogiri, ruby nokogiri gem, debian linux +5 more +7 more Nokogiri vulnerable to DoS while parsing XML documents CVE-2013-6460 Fix available 6.5 MediumNovember 5, 2019
• hackerone ruby Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface... CVE-2016-2336 9.8 CriticalJanuary 6, 2017
• hackerone ruby An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize"... CVE-2016-2339 Fix available 9.8 CriticalJanuary 6, 2017
• hackerone ruby, tcl tcl/tk +1 more Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different... CVE-2016-2337 Fix available 9.8 CriticalJanuary 6, 2017
• hackerone ruby, debian linux, puppet agent +2 more +4 more verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x... CVE-2015-1855 Public exploitFix available 5.9 MediumApril 9, 2015