RHSA-2026:34076 — Red Hat Security Advisory: ruby:2.5 security update

Fixed packages 92

Release	Package	Fixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-debuginfo	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-debugsource	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-devel	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-doc	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-irb	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-libs	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	ruby-libs-debuginfo	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-abrt	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-abrt-doc	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bigdecimal	0:1.3.4-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bigdecimal-debuginfo	0:1.3.4-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bson	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bson-debuginfo	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bson-debugsource	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bson-doc	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bundler	0:1.16.1-4.module+el8.6.0+14229+2452087f
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-bundler-doc	0:1.16.1-4.module+el8.6.0+14229+2452087f
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-did_you_mean	0:1.2.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-io-console	0:0.4.6-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-io-console-debuginfo	0:0.4.6-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-json	0:2.1.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-json-debuginfo	0:2.1.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-minitest	0:5.10.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mongo	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mongo-doc	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mysql2	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mysql2-debuginfo	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mysql2-debugsource	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-mysql2-doc	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-net-telnet	0:0.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-openssl	0:2.1.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-openssl-debuginfo	0:2.1.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-pg	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-pg-debuginfo	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-pg-debugsource	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-pg-doc	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-power_assert	0:1.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-psych	0:3.0.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-psych-debuginfo	0:3.0.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-rake	0:12.3.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-rdoc	0:6.0.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-test-unit	0:3.2.7-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygem-xmlrpc	0:0.3.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygems	0:2.7.6.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	rubygems-devel	0:2.7.6.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-debuginfo	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-debugsource	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-devel	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-doc	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-irb	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-libs	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	ruby-libs-debuginfo	0:2.5.9-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-abrt	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-abrt-doc	0:0.3.0-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bigdecimal	0:1.3.4-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bigdecimal-debuginfo	0:1.3.4-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bson	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bson-debuginfo	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bson-debugsource	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bson-doc	0:4.3.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bundler	0:1.16.1-4.module+el8.6.0+14229+2452087f
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-bundler-doc	0:1.16.1-4.module+el8.6.0+14229+2452087f
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-did_you_mean	0:1.2.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-io-console	0:0.4.6-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-io-console-debuginfo	0:0.4.6-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-json	0:2.1.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-json-debuginfo	0:2.1.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-minitest	0:5.10.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mongo	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mongo-doc	0:2.5.1-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mysql2	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mysql2-debuginfo	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mysql2-debugsource	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-mysql2-doc	0:0.4.10-4.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-net-telnet	0:0.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-openssl	0:2.1.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-openssl-debuginfo	0:2.1.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-pg	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-pg-debuginfo	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-pg-debugsource	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-pg-doc	0:1.0.0-2.module+el8.1.0+3656+f80bfa1d
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-power_assert	0:1.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-psych	0:3.0.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-psych-debuginfo	0:3.0.2-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-rake	0:12.3.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-rdoc	0:6.0.1.1-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-test-unit	0:3.2.7-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygem-xmlrpc	0:0.3.0-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygems	0:2.7.6.3-112.module+el8.8.0+24452+e70e99ef
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	rubygems-devel	0:2.7.6.3-112.module+el8.8.0+24452+e70e99ef

Vulnerabilities 2

High 7.6

CVE-2026-42246

net-imap vulnerable to STARTTLS stripping via invalid response timing

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems

May 9, 2026
Medium 5.8

CVE-2026-42258

net-imap: Command Injection via unvalidated Symbol inputs

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMA…

ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

May 9, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468498
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468499
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34076.json
report
https://access.redhat.com/security/cve/CVE-2026-42246
advisory
https://www.cve.org/CVERecord?id=CVE-2026-42246
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42246
article
https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618
article
https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e
article
https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c
article
https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da
article
https://github.com/ruby/net-imap/releases/tag/v0.3.10
article
https://github.com/ruby/net-imap/releases/tag/v0.4.24
article
https://github.com/ruby/net-imap/releases/tag/v0.5.14
article
https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp
report
https://access.redhat.com/security/cve/CVE-2026-42258
advisory
https://www.cve.org/CVERecord?id=CVE-2026-42258
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42258
article
https://github.com/ruby/net-imap/releases/tag/v0.6.4
article
https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px

Red Hat Security Advisory: ruby:2.5 security update

Fixed packages 92

Vulnerabilities 2

net-imap vulnerable to STARTTLS stripping via invalid response timing

net-imap: Command Injection via unvalidated Symbol inputs

References