Skip to content
OpenAdvisories
High RHSA-2026:26655 1 CVE

Red Hat Security Advisory: ruby:3.3 security update

Published Jun 18, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 42

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-bundled-gems 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-bundled-gems-debuginfo 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-debuginfo 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-debugsource 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-default-gems 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-devel 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-doc 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-libs 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream ruby-libs-debuginfo 0:3.3.10-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bigdecimal 0:3.1.5-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bigdecimal-debuginfo 0:3.1.5-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-bundler 0:2.5.22-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-io-console 0:0.7.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-io-console-debuginfo 0:0.7.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-irb 0:1.13.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-json 0:2.7.2-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-json-debuginfo 0:2.7.2-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-minitest 0:5.20.0-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-mysql2 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-mysql2-debuginfo 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-mysql2-debugsource 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-mysql2-doc 0:0.5.5-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-pg 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-pg-debuginfo 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-pg-debugsource 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-pg-doc 0:1.5.4-1.module+el9.4.0+21222+faeeed2f
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-power_assert 0:2.0.3-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-psych 0:5.1.2-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-psych-debuginfo 0:5.1.2-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-racc 0:1.7.3-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-racc-debuginfo 0:1.7.3-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rake 0:13.1.0-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rbs 0:3.4.0-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rbs-debuginfo 0:3.4.0-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rdoc 0:6.6.3.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rexml 0:3.4.4-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-rss 0:0.3.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-test-unit 0:3.6.1-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygem-typeprof 0:0.21.9-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygems 0:3.5.22-6.module+el9.4.0+24333+ed4ca411
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream rubygems-devel 0:3.5.22-6.module+el9.4.0+24333+ed4ca411

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461369
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26655.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41316
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41316
  • article
    https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv