Skip to content
OpenAdvisories
High RHSA-2026:33478 1 CVE

Red Hat Security Advisory: ruby security update

Published Jul 1, 2026 · Updated Aug 22, 2026

Ecosystem: Red Hat

Fixed packages 34

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-bundled-gems 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-bundled-gems-debuginfo 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-debuginfo 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-debugsource 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-default-gems 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-devel 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-doc 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-libs 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 ruby-libs-debuginfo 0:3.3.10-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-bigdecimal 0:3.1.5-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-bigdecimal-debuginfo 0:3.1.5-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-bundler 0:2.5.22-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-io-console 0:0.7.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-io-console-debuginfo 0:0.7.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-irb 0:1.13.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-json 0:2.7.2-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-json-debuginfo 0:2.7.2-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-minitest 0:5.20.0-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-power_assert 0:2.0.3-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-psych 0:5.1.2-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-psych-debuginfo 0:5.1.2-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-racc 0:1.7.3-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-racc-debuginfo 0:1.7.3-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rake 0:13.1.0-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rbs 0:3.4.0-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rbs-debuginfo 0:3.4.0-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rdoc 0:6.6.3.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rexml 0:3.4.4-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-rss 0:0.3.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-test-unit 0:3.6.1-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygem-typeprof 0:0.21.9-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygems 0:3.5.22-11.el10_0.1
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 rubygems-devel 0:3.5.22-11.el10_0.1

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461369
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33478.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41316
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41316
  • article
    https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv