Skip to content
OpenAdvisories
High ALSA-2026:18065 1 CVE

Important: ruby security update

Published May 18, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 14

ReleasePackageFixed in
AlmaLinux · 10 ruby-default-gems 3.3.10-12.el10_1
AlmaLinux · 10 ruby-doc 3.3.10-12.el10_1
AlmaLinux · 10 rubygem-bundler 2.5.22-12.el10_1
AlmaLinux · 10 rubygem-irb 1.13.1-12.el10_1
AlmaLinux · 10 rubygem-minitest 5.20.0-12.el10_1
AlmaLinux · 10 rubygem-power_assert 2.0.3-12.el10_1
AlmaLinux · 10 rubygem-rake 13.1.0-12.el10_1
AlmaLinux · 10 rubygem-rdoc 6.6.3.1-12.el10_1
AlmaLinux · 10 rubygem-rexml 3.4.4-12.el10_1
AlmaLinux · 10 rubygem-rss 0.3.1-12.el10_1
AlmaLinux · 10 rubygem-test-unit 3.6.1-12.el10_1
AlmaLinux · 10 rubygem-typeprof 0.21.9-12.el10_1
AlmaLinux · 10 rubygems 3.5.22-12.el10_1
AlmaLinux · 10 rubygems-devel 3.5.22-12.el10_1

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-41316
  • report
    https://bugzilla.redhat.com/2461369
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-18065.html