Summary
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
* resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212)
* rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection (CVE-2026-88030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 |
| Rocky Linux · 8 | rubygem-abrt | 0:0.3.0-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux · 8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+1536+5f79634e |
| Rocky Linux · 8 | rubygem-bundler | 0:1.16.1-5.module+el8.10.0+1979+815637df |
| Rocky Linux · 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux · 8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+1536+5f79634e |
Vulnerabilities 2
-
High 8.3
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…
-
High 7.5
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource…