Skip to content
OpenAdvisories
High RHSA-2026:26312 1 CVE

Red Hat Security Advisory: ruby security update

Published Jun 17, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-debuginfo 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-debugsource 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-default-gems 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-devel 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-libs 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-libs-debuginfo 0:3.0.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bigdecimal 0:3.0.0-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bigdecimal-debuginfo 0:3.0.0-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bundler 0:2.2.33-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-io-console 0:0.5.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-io-console-debuginfo 0:0.5.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-irb 0:1.3.5-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-json 0:2.5.1-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-json-debuginfo 0:2.5.1-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-minitest 0:5.14.2-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-power_assert 0:1.2.1-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-psych 0:3.3.2-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-psych-debuginfo 0:3.3.2-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rake 0:13.0.3-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rbs 0:1.4.0-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rdoc 0:6.3.4.1-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rexml 0:3.2.5-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rss 0:0.2.9-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-test-unit 0:3.3.7-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-typeprof 0:0.15.2-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygems 0:3.2.33-162.el9_4.2
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygems-devel 0:3.2.33-162.el9_4.2

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461369
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26312.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41316
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41316
  • article
    https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv