Skip to content
OpenAdvisories
High RLSA-2026:20614 1 CVE

Important: ruby:3.3 security update

Published May 26, 2026 · Updated May 26, 2026

Ecosystem: Rocky Linux

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 11

ReleasePackageFixed in
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.10.0+1679+61871737
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.10.0+1820+f3fffb92
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.10.0+1826+b62220b4
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.5.0+668+665814fa
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2
Rocky Linux · 8 rubygem-abrt 0:0.4.0-1.module+el8.9.0+1537+0b2034bd
Rocky Linux · 8 rubygem-mysql2 0:0.5.5-1.module+el8.10.0+1679+61871737
Rocky Linux · 8 rubygem-mysql2 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2
Rocky Linux · 8 rubygem-pg 0:1.5.4-1.module+el8.10.0+1679+61871737
Rocky Linux · 8 rubygem-pg 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2

Vulnerabilities 1

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461369