Skip to content
OpenAdvisories
High RHSA-2025:23063 3 CVEs

Red Hat Security Advisory: ruby:3.3 security update

Published Jan 3, 2026 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 42

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-bundled-gems 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-bundled-gems-debuginfo 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-debuginfo 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-debugsource 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-default-gems 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-devel 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-doc 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-libs 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream ruby-libs-debuginfo 0:3.3.10-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-bigdecimal 0:3.1.5-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-bigdecimal-debuginfo 0:3.1.5-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-bundler 0:2.5.22-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-io-console 0:0.7.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-io-console-debuginfo 0:0.7.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-irb 0:1.13.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-json 0:2.7.2-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-json-debuginfo 0:2.7.2-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-minitest 0:5.20.0-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-mysql2 0:0.5.5-3.module+el9.7.0+23362+7018fe7e
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-mysql2-debuginfo 0:0.5.5-3.module+el9.7.0+23362+7018fe7e
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-mysql2-debugsource 0:0.5.5-3.module+el9.7.0+23362+7018fe7e
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-mysql2-doc 0:0.5.5-3.module+el9.7.0+23362+7018fe7e
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-pg 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-pg-debuginfo 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-pg-debugsource 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-pg-doc 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-power_assert 0:2.0.3-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-psych 0:5.1.2-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-psych-debuginfo 0:5.1.2-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-racc 0:1.7.3-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-racc-debuginfo 0:1.7.3-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rake 0:13.1.0-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rbs 0:3.4.0-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rbs-debuginfo 0:3.4.0-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rdoc 0:6.6.3.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rexml 0:3.4.4-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-rss 0:0.3.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-test-unit 0:3.6.1-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygem-typeprof 0:0.21.9-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygems 0:3.5.22-5.module+el9.7.0+23651+15dc1615
Red Hat · RHEL 9 enterprise_linux:9::appstream rubygems-devel 0:3.5.22-5.module+el9.7.0+23651+15dc1615

Vulnerabilities 3

  • High 7.5
    CVE-2025-24294

    resolv vulnerable to DoS via insufficient DNS domain name length validation

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …

    ruby resolv ruby2.3 ruby2.5 Debian Ubuntu Azure Linux Wolfi RubyGems
  • Low 2.1
    CVE-2025-61594

    URI Credential Leakage Bypass over CVE-2025-27221

    URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to…

    ruby uri ruby2.3 ruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  • Low 1.2
    CVE-2025-58767

    REXML has a DoS condition when parsing malformed XML file

    REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379684
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396186
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23063.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-24294
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-24294
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-24294
  • article
    https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/
  • report
    https://access.redhat.com/security/cve/CVE-2025-58767
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-58767
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-58767
  • article
    https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23
  • article
    https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5
  • report
    https://access.redhat.com/security/cve/CVE-2025-61594
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2426336
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-61594
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-61594
  • article
    https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902
  • article
    https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c
  • article
    https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a
  • article
    https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml
  • article
    https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/