Ruby-lang vulnerabilities

Products

• Ruby 94
• Rexml 8
• Net\ 6
• Cgi 5
• Webrick 5
• Uri 4
• Openssl 2
• Rdoc 2

Newest

• gitlab, gitlab community edition and enterprise edition, ruby-lang ruby +2 more Integer Overflow or Wraparound in GitLab CVE-2026-97229 In KEVPublic exploitFix available EPSS 27.3% 10.0 CriticalOctober 13, 2026
• hackerone ruby An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in... CVE-2026-46727 Fix available 8.1 HighMay 21, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Command Injection via "raw" arguments to multiple commands CVE-2026-42257 Fix available 5.8 MediumMay 4, 2026
• ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +19 more +21 more net-imap: Command Injection via unvalidated Symbol inputs CVE-2026-42258 Fix available 5.8 MediumMay 4, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Denial of service via high iteration count for `SCRAM-*` authentication CVE-2026-42256 Fix available 6.0 MediumMay 4, 2026
• ruby net-imap, ruby-lang net\ +1 more net-imap: Quadratic complexity when reading response literals CVE-2026-42245 Fix available 2.3 LowMay 4, 2026
• ruby zlib zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption CVE-2026-27820 Fix available 1.7 LowMarch 20, 2026
• ruby json, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +6 more +8 more Ruby JSON has a format string injection vulnerability CVE-2026-33210 Fix available 8.3 HighMarch 19, 2026
• ruby uri URI Credential Leakage Bypass over CVE-2025-27221 CVE-2025-61594 Fix available 2.1 LowOctober 8, 2025
• ruby rexml REXML has a DoS condition when parsing malformed XML file CVE-2025-58767 Fix available 1.2 LowSeptember 17, 2025
• ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +17 more +19 more net-imap vulnerable to STARTTLS stripping via invalid response timing CVE-2026-42246 Fix available 7.6 HighJune 29, 2025
• ruby webrick Ruby WEBrick read_header HTTP Request Smuggling Vulnerability CVE-2025-6442 Fix available 6.5 MediumJune 25, 2025
• ruby net-imap, ruby-lang net\ +1 more net-imap rubygem vulnerable to possible DoS by memory exhaustion CVE-2025-43857 Fix available 6.0 MediumApril 28, 2025
• ruby json, ruby-lang javascript object notation +1 more Ruby JSON Parser has Out-of-bounds Read CVE-2025-27788 Fix available 7.5 HighMarch 12, 2025
• ruby uri URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ CVE-2025-27221 Fix available 3.2 LowMarch 3, 2025
• ruby-lang cgi CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement CVE-2025-27220 Fix available 4.0 MediumMarch 3, 2025
• ruby-lang cgi CGI has Denial of Service (DoS) potential in Cookie.parse CVE-2025-27219 Fix available 5.8 MediumMarch 3, 2025
• ruby rexml, netapp ontap tools +1 more REXML ReDoS vulnerability CVE-2024-49761 Fix available 6.6 MediumOctober 28, 2024
• ruby rexml, netapp bootstrap os +1 more REXML denial of service vulnerability CVE-2024-43398 Fix available 5.9 MediumAugust 22, 2024
• ruby rexml REXML DoS vulnerability CVE-2024-41946 Fix available 5.3 MediumAugust 1, 2024
• ruby rexml REXML DoS vulnerability CVE-2024-41123 Fix available 5.3 MediumAugust 1, 2024
• ruby rexml, netapp bootstrap os +1 more Denial of service in REXML CVE-2024-39908 Public exploitFix available 4.3 MediumJuly 16, 2024
• ruby rexml REXML contains a denial of service vulnerability CVE-2024-35176 Public exploitFix available 5.3 MediumMay 16, 2024
• ruby-lang ruby StringIO buffer overread vulnerability CVE-2024-27280 Fix available 9.8 CriticalMarch 25, 2024
• ruby-lang uri URI gem has ReDoS vulnerability CVE-2023-36617 Fix available 5.3 MediumJune 29, 2023
• ruby-lang ruby, time, debian linux +1 more +3 more Ruby Time component ReDoS issue CVE-2023-28756 Fix available 5.3 MediumMarch 31, 2023
• ruby-lang uri, debian linux, fedoraproject fedora +2 more Ruby URI component ReDoS issue CVE-2023-28755 Fix available 5.3 MediumMarch 31, 2023
• ruby-lang cgi, ruby, fedoraproject fedora +2 more HTTP response splitting in CGI CVE-2021-33621 Fix available 8.8 HighNovember 18, 2022
• ruby-lang ruby, apple macos, debian linux +2 more There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1... CVE-2022-28739 Fix available 7.5 HighApril 15, 2022
• ruby-lang ruby A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.... CVE-2022-28738 Fix available 9.8 CriticalApril 15, 2022
• ruby-lang cgi, ruby, debian linux +6 more +8 more Cookie Prefix Spoofing in CGI::Cookie.parse CVE-2021-41819 Fix available 7.5 HighDecember 23, 2021
• ruby-lang cgi, fedoraproject fedora +1 more Buffer overrun in CGI.escape_html CVE-2021-41816 Fix available 9.8 CriticalDecember 2, 2021
• ruby-lang date, ruby, debian linux +6 more +8 more Regular expression denial of service vulnerability (ReDoS) in date CVE-2021-41817 Fix available 7.5 HighNovember 16, 2021
• ruby-lang ruby, oracle jd edwards enterpriseone tools +1 more An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net:... CVE-2021-32066 Fix available 7.4 HighJuly 15, 2021
• ruby-lang rdoc, debian linux, oracle jd edwards enterpriseone tools +2 more Arbitrary Code Execution in Rdoc CVE-2021-31799 Fix available 7.0 HighJuly 15, 2021
• ruby-lang ruby, debian linux, oracle jd edwards enterpriseone tools +2 more An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A... CVE-2021-31810 Fix available 5.8 MediumJuly 13, 2021
• ruby-lang ruby Tempfile on Windows path traversal vulnerability CVE-2021-28966 Fix available EPSS 58.0% 7.5 HighMay 6, 2021
• ruby-lang rexml, ruby, fedoraproject fedora +2 more REXML round-trip instability CVE-2021-28965 Fix available 7.5 HighApril 12, 2021
• ruby-lang ruby, webrick, fedoraproject fedora +2 more WEBRick vulnerable to HTTP Request/Response Smuggling CVE-2020-25613 Public exploitFix available 7.5 HighOctober 1, 2020
• ruby-lang ruby, debian linux, fedoraproject fedora +2 more An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim... CVE-2020-10933 Fix available 5.3 MediumApril 15, 2020
• puma, ruby-lang ruby, debian linux +1 more +3 more HTTP Response Splitting in Puma CVE-2020-5247 Fix available 6.5 MediumFebruary 28, 2020
• ruby-lang rake, canonical ubuntu linux, debian linux +2 more +4 more OS Command Injection in Rake CVE-2020-8130 Fix available 6.4 MediumFebruary 24, 2020
• ruby-lang ruby, debian linux +1 more An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function... CVE-2016-2338 Public exploitFix available 9.8 CriticalFebruary 14, 2020
• openssl extension of ruby (git trunk), ruby-lang ruby +1 more The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always... CVE-2011-4121 9.8 CriticalNovember 26, 2019
• hackerone ruby Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X... CVE-2011-3624 5.3 MediumNovember 26, 2019
• ruby-lang ruby, debian linux, opensuse leap +1 more +3 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the... CVE-2019-16255 Fix available 8.1 HighNovember 20, 2019
• ruby-lang ruby, debian linux +1 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting.... CVE-2019-16254 Fix available 5.3 MediumNovember 20, 2019
• ruby-lang ruby, debian linux +1 more WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4... CVE-2019-16201 Fix available 7.5 HighNovember 20, 2019
• ruby-lang ruby, canonical ubuntu linux +1 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within... CVE-2019-15845 Fix available 6.5 MediumNovember 20, 2019
• ruby-lang ruby193 ruby193 uses an insecure LD_LIBRARY_PATH setting. CVE-2013-1945 3.3 LowOctober 31, 2019
• Show olderLoading…