Ruby-lang Ruby vulnerabilities

• gitlab, gitlab community edition and enterprise edition, ruby-lang ruby +2 more Integer Overflow or Wraparound in GitLab CVE-2026-97229 In KEVPublic exploitFix available EPSS 27.7% 10.0 CriticalOctober 13, 2026
• hackerone ruby An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in... CVE-2026-46727 Fix available 8.1 HighMay 21, 2026
• ruby-lang ruby StringIO buffer overread vulnerability CVE-2024-27280 Fix available 9.8 CriticalMarch 25, 2024
• ruby-lang ruby, time, debian linux +1 more +3 more Ruby Time component ReDoS issue CVE-2023-28756 Fix available 5.3 MediumMarch 31, 2023
• ruby-lang cgi, ruby, fedoraproject fedora +2 more HTTP response splitting in CGI CVE-2021-33621 Fix available 8.8 HighNovember 18, 2022
• ruby-lang ruby, apple macos, debian linux +2 more There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1... CVE-2022-28739 Fix available 7.5 HighApril 15, 2022
• ruby-lang ruby A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.... CVE-2022-28738 Fix available 9.8 CriticalApril 15, 2022
• ruby-lang cgi, ruby, debian linux +6 more +8 more Cookie Prefix Spoofing in CGI::Cookie.parse CVE-2021-41819 Fix available 7.5 HighDecember 23, 2021
• ruby-lang date, ruby, debian linux +6 more +8 more Regular expression denial of service vulnerability (ReDoS) in date CVE-2021-41817 Fix available 7.5 HighNovember 16, 2021
• ruby-lang ruby, oracle jd edwards enterpriseone tools +1 more An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net:... CVE-2021-32066 Fix available 7.4 HighJuly 15, 2021
• ruby-lang ruby, debian linux, oracle jd edwards enterpriseone tools +2 more An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A... CVE-2021-31810 Fix available 5.8 MediumJuly 13, 2021
• ruby-lang ruby Tempfile on Windows path traversal vulnerability CVE-2021-28966 Fix available EPSS 58.0% 7.5 HighMay 6, 2021
• ruby-lang rexml, ruby, fedoraproject fedora +2 more REXML round-trip instability CVE-2021-28965 Fix available 7.5 HighApril 12, 2021
• ruby-lang ruby, webrick, fedoraproject fedora +2 more WEBRick vulnerable to HTTP Request/Response Smuggling CVE-2020-25613 Public exploitFix available 7.5 HighOctober 1, 2020
• ruby-lang ruby, debian linux, fedoraproject fedora +2 more An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim... CVE-2020-10933 Fix available 5.3 MediumApril 15, 2020
• puma, ruby-lang ruby, debian linux +1 more +3 more HTTP Response Splitting in Puma CVE-2020-5247 Fix available 6.5 MediumFebruary 28, 2020
• ruby-lang ruby, debian linux +1 more An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function... CVE-2016-2338 Public exploitFix available 9.8 CriticalFebruary 14, 2020
• openssl extension of ruby (git trunk), ruby-lang ruby +1 more The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always... CVE-2011-4121 9.8 CriticalNovember 26, 2019
• hackerone ruby Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X... CVE-2011-3624 5.3 MediumNovember 26, 2019
• ruby-lang ruby, debian linux, opensuse leap +1 more +3 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the... CVE-2019-16255 Fix available 8.1 HighNovember 20, 2019
• ruby-lang ruby, debian linux +1 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting.... CVE-2019-16254 Fix available 5.3 MediumNovember 20, 2019
• ruby-lang ruby, debian linux +1 more WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4... CVE-2019-16201 Fix available 7.5 HighNovember 20, 2019
• ruby-lang ruby, canonical ubuntu linux +1 more Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within... CVE-2019-15845 Fix available 6.5 MediumNovember 20, 2019
• ruby-lang ruby193 ruby193 uses an insecure LD_LIBRARY_PATH setting. CVE-2013-1945 3.3 LowOctober 31, 2019
• ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 more An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x... CVE-2018-16396 Fix available 8.1 HighOctober 26, 2018
• ruby-lang openssl, ruby, canonical ubuntu linux +2 more +4 more Ruby Openssl Allows Incorrect Value Comparison CVE-2018-16395 Fix available EPSS 10.7% 9.8 CriticalOctober 26, 2018
• ruby-lang ruby, canonical ubuntu linux, debian linux +2 more In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0... CVE-2018-8780 Fix available 9.1 CriticalApril 3, 2018
• ruby-lang ruby, canonical ubuntu linux, debian linux +2 more In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0... CVE-2018-8779 Fix available 7.5 HighApril 3, 2018
• ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 more In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0... CVE-2018-8778 Fix available 7.5 HighApril 3, 2018
• ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 more In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0... CVE-2018-8777 Fix available 7.5 HighApril 3, 2018
• ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 more Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before... CVE-2018-6914 Fix available EPSS 10.2% 7.5 HighApril 3, 2018
• ruby-lang ruby, debian linux +1 more Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0... CVE-2017-17742 Fix available 5.3 MediumApril 3, 2018
• ruby-lang ruby The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might... CVE-2017-17790 Fix available 9.8 CriticalDecember 20, 2017
• ruby-lang ruby, debian linux, redhat enterprise linux desktop +5 more +7 more Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile,... CVE-2017-17405 Public exploitFix available EPSS 73.8% 8.8 HighDecember 15, 2017
• ruby-lang ruby Ruby OpenSSL DoS Vulnerability CVE-2017-14033 Fix available 7.5 HighSeptember 19, 2017
• ruby-lang ruby WEBrick RCE Vulnerability CVE-2017-10784 Fix available EPSS 16.4% 8.8 HighSeptember 19, 2017
• hackerone ruby Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a... CVE-2017-0898 Fix available 9.1 CriticalSeptember 15, 2017
• ruby-lang ruby, canonical ubuntu linux, debian linux +6 more +8 more Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory... CVE-2017-14064 Fix available 9.8 CriticalAugust 31, 2017
• ruby-lang ruby The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial... CVE-2017-11465 9.8 CriticalJuly 19, 2017
• ruby-lang ruby Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a... CVE-2015-9096 Fix available 6.1 MediumJune 12, 2017
• oniguruma project oniguruma, php, ruby-lang ruby +2 more An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and... CVE-2017-9225 Fix available 9.8 CriticalMay 24, 2017
• oniguruma project oniguruma, php, ruby-lang ruby +2 more An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and... CVE-2017-9229 Fix available 7.5 HighMay 24, 2017
• ruby-lang ruby The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression... CVE-2017-6181 7.5 HighApril 3, 2017
• hackerone ruby Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface... CVE-2016-2336 9.8 CriticalJanuary 6, 2017
• hackerone ruby An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize"... CVE-2016-2339 Fix available 9.8 CriticalJanuary 6, 2017
• hackerone ruby, tcl tcl/tk +1 more Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different... CVE-2016-2337 Fix available 9.8 CriticalJanuary 6, 2017
• ruby-lang ruby, apple mac os x +1 more The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2... CVE-2015-7551 Fix available 8.4 HighJanuary 12, 2016
• ruby-lang ruby DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8... CVE-2009-5147 Public exploitFix available 7.3 HighAugust 26, 2015
• ruby-lang ruby The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to... CVE-2014-6438 Fix available 7.5 HighJuly 18, 2015
• ruby-lang ruby, rubygems, oracle solaris +1 more +3 more RubyGems vulnerable to DNS hijack attack CVE-2015-3900 Fix available 5.0 MediumJune 24, 2015
• Show olderLoading…