Skip to content
OpenAdvisories
Critical USN-7734-1 4 CVEs

ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities

Published Sep 3, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby incorrectly handled certain IO stream
methods. A remote attacker could use this issue to cause Ruby to crash,
resulting in a denial of service, or possibly obtain sensitive
information. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-27280)

It was discovered that the Ruby regex compiler incorrectly handled
certain memory operations. A remote attacker could possibly use this
issue to obtain sensitive memory contents. This issue only affected
Ubuntu 18.04 LTS. (CVE-2024-27282)

It was discovered that Ruby incorrectly handled parsing of certain XML
characters through the REXML gem. An attacker could use this issue to
cause Ruby to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS. (CVE-2024-35176)

It was discovered that Ruby incorrectly handled decompressed domain names
within a DNS packet. An attacker could use this issue to cause Ruby to
crash, resulting in a denial of service. (CVE-2025-24294)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS ruby3.0 3.0.2-7ubuntu2.11
Ubuntu · 24.04 LTS 24.04:LTS ruby3.2 3.2.3-1ubuntu0.24.04.6
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby2.5 2.5.1-1ubuntu1.16+esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ruby2.7 2.7.0-5ubuntu1.18+esm1

Vulnerabilities 4

  • Critical 9.8
    CVE-2024-27280

    StringIO buffer overread vulnerability

    A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine Wolfi RubyGems
  • High 7.5
    CVE-2025-24294

    resolv vulnerable to DoS via insufficient DNS domain name length validation

    The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain …

    ruby resolv ruby2.3 ruby2.5 Debian Ubuntu Azure Linux Wolfi RubyGems
  • Medium 6.6
    CVE-2024-27282

    An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2024-35176 Public exploit

    REXML contains a denial of service vulnerability

    REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.…

    ruby rexml kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2024-27280
  • report
    https://ubuntu.com/security/CVE-2024-27282
  • report
    https://ubuntu.com/security/CVE-2024-35176
  • report
    https://ubuntu.com/security/CVE-2025-24294