Skip to content
OpenAdvisories
High RHSA-2026:18065 1 CVE

Red Hat Security Advisory: ruby security update

Published May 19, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 34

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 ruby 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-bundled-gems 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-bundled-gems-debuginfo 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-debuginfo 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-debugsource 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-default-gems 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-devel 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-doc 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-libs 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 ruby-libs-debuginfo 0:3.3.10-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-bigdecimal 0:3.1.5-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-bigdecimal-debuginfo 0:3.1.5-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-bundler 0:2.5.22-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-io-console 0:0.7.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-io-console-debuginfo 0:0.7.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-irb 0:1.13.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-json 0:2.7.2-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-json-debuginfo 0:2.7.2-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-minitest 0:5.20.0-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-power_assert 0:2.0.3-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-psych 0:5.1.2-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-psych-debuginfo 0:5.1.2-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-racc 0:1.7.3-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-racc-debuginfo 0:1.7.3-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rake 0:13.1.0-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rbs 0:3.4.0-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rbs-debuginfo 0:3.4.0-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rdoc 0:6.6.3.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rexml 0:3.4.4-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-rss 0:0.3.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-test-unit 0:3.6.1-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygem-typeprof 0:0.21.9-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygems 0:3.5.22-12.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 rubygems-devel 0:3.5.22-12.el10_1

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461369
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18065.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41316
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41316
  • article
    https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv