Ruby-lang - vulnerabilities (CVEs)

124 CVEs in 16 products, 0 in the last 30 days, newest from 2026-05-22.

Products

Ruby - 93 CVEs
Rexml - 8 CVEs
Net\ - 6 CVEs
Cgi - 5 CVEs
Webrick - 5 CVEs
Uri - 4 CVEs
Openssl - 2 CVEs
Rdoc - 2 CVEs
Date - 1 CVEs
Javascript Object Notation - 1 CVEs
Json - 1 CVEs
Rake - 1 CVEs
Ruby193 - 1 CVEs
Time - 1 CVEs
Trunk - 1 CVEs
Zlib - 1 CVEs

Newest CVEs of Ruby-lang

CVE-2026-46727 - CVSS 8.1 (high), 2026-05-22: An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo…
CVE-2026-42256 - CVSS 6.5 (medium), 2026-05-09: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and…
CVE-2026-42246 - CVSS 7.6 (high), 2026-05-09: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a…
CVE-2026-42258 - CVSS 7.1 (high), 2026-05-09: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to…
CVE-2026-42245 - CVSS 7.5 (high), 2026-05-09: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4,…
CVE-2026-42257 - CVSS 9.8 (critical), 2026-05-09: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP…
CVE-2026-27820 - CVSS 9.8 (critical), 2026-04-16: zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow…
CVE-2026-33210 - CVSS 9.1 (critical), 2026-03-20: Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability…
CVE-2025-61594 - CVSS 7.5 (high), 2025-12-30: URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier…
CVE-2025-58767 - CVSS 5.3 (medium), 2025-09-17: REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you…
CVE-2025-6442 - CVSS 6.5 (medium), 2025-06-25: Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected…
CVE-2025-43857 - CVSS 6.5 (medium), 2025-04-28: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a…
CVE-2025-27788 - CVSS 7.5 (high), 2025-03-12: JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read,…
CVE-2025-27221 - CVSS 5.3 (medium), 2025-03-04: In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because…
CVE-2025-27220 - CVSS 7.5 (high), 2025-03-04: In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVE-2025-27219 - CVSS 7.5 (high), 2025-03-04: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method…
CVE-2024-49761 - CVSS 7.5 (high), 2024-10-28: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a…
CVE-2024-43398 - CVSS 5.9 (medium), 2024-08-22: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local…
CVE-2024-41946 - CVSS 7.5 (high), 2024-08-01: REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser…
CVE-2024-41123 - CVSS 7.5 (high), 2024-08-01: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as…
CVE-2024-39908 - CVSS 4.3 (medium), 2024-07-16: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`,…
CVE-2024-35176 - CVSS 5.3 (medium), 2024-05-16: REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute…
CVE-2024-27280 - CVSS 9.8 (critical), 2024-05-14: A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods…
CVE-2023-36617 - CVSS 5.3 (medium), 2023-06-29: A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an…
CVE-2023-28755 - CVSS 5.3 (medium), 2023-03-31: A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters.…
CVE-2023-28756 - CVSS 5.3 (medium), 2023-03-31: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters.…
CVE-2021-33621 - CVSS 8.8 (high), 2022-11-18: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use…
CVE-2016-2338 - CVSS 9.8 (critical), 2022-09-29: An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer…
CVE-2022-28739 - CVSS 7.5 (high), 2022-05-09: There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion,…
CVE-2022-28738 - CVSS 9.8 (critical), 2022-05-09: A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user…