RHSA-2026:33462 — Red Hat Security Advisory: ruby security update

Fixed packages 29

Release	Package	Fixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-debuginfo	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-debugsource	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-default-gems	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-devel	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-libs	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	ruby-libs-debuginfo	0:3.0.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-bigdecimal	0:3.0.0-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-bigdecimal-debuginfo	0:3.0.0-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-bundler	0:2.2.33-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-io-console	0:0.5.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-io-console-debuginfo	0:0.5.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-irb	0:1.3.5-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-json	0:2.5.1-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-json-debuginfo	0:2.5.1-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-minitest	0:5.14.2-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-power_assert	0:1.2.1-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-psych	0:3.3.2-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-psych-debuginfo	0:3.3.2-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-rake	0:13.0.3-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-rbs	0:1.4.0-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-rdoc	0:6.3.4.1-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-rexml	0:3.2.5-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-rss	0:0.2.9-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-test-unit	0:3.3.7-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygem-typeprof	0:0.15.2-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygems	0:3.2.33-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream	rubygems-devel	0:3.2.33-165.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb	ruby-doc	0:3.0.7-165.el9_6.1

Vulnerabilities 3

High 8.1

CVE-2026-41316

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

ruby erb logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems

Apr 24, 2026
High 7.6

CVE-2026-42246

net-imap vulnerable to STARTTLS stripping via invalid response timing

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems

May 9, 2026
Medium 5.8

CVE-2026-42258

net-imap: Command Injection via unvalidated Symbol inputs

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMA…

ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

May 9, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461369
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468498
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468499
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33462.json
report
https://access.redhat.com/security/cve/CVE-2026-41316
advisory
https://www.cve.org/CVERecord?id=CVE-2026-41316
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41316
article
https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv
report
https://access.redhat.com/security/cve/CVE-2026-42246
advisory
https://www.cve.org/CVERecord?id=CVE-2026-42246
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42246
article
https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
article
https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
article
https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
article
https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
article
https://github.com/ruby/net-imap/releases/tag/v0.3.10
article
https://github.com/ruby/net-imap/releases/tag/v0.4.24
article
https://github.com/ruby/net-imap/releases/tag/v0.5.14
article
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
report
https://access.redhat.com/security/cve/CVE-2026-42258
advisory
https://www.cve.org/CVERecord?id=CVE-2026-42258
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42258
article
https://github.com/ruby/net-imap/releases/tag/v0.6.4
article
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px

Red Hat Security Advisory: ruby security update

Fixed packages 29

Vulnerabilities 3

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

net-imap vulnerable to STARTTLS stripping via invalid response timing

net-imap: Command Injection via unvalidated Symbol inputs

References