Ruby: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• High 8.1
  CVE-2026-41316

  ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

  ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

  ruby erb logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  Apr 24, 2026
• High 7.6
  CVE-2026-42246

  net-imap vulnerable to STARTTLS stripping via invalid response timing

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issu…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 6.0
  CVE-2026-42256

  net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile ser…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-42257

  net-imap: Command Injection via "raw" arguments to multiple commands

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this …

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-42258

  net-imap: Command Injection via unvalidated Symbol inputs

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMA…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Medium 5.8
  CVE-2026-47240

  Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a se…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Jun 22, 2026
• Medium 5.8
  CVE-2026-47242

  Net::IMAP: Command Injection via ID command argument

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they w…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Jun 22, 2026
• Low 2.3
  CVE-2026-42245

  net-imap: Quadratic complexity when reading response literals

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hos…

  ruby net-imap logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Alpine Wolfi RubyGems
  May 9, 2026
• Low 2.1
  CVE-2026-47241

  Net::IMAP: Denial of Service via incomplete raw argument validation

  Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this str…

  ruby net-imap logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Alpine Wolfi RubyGems
  Jun 22, 2026

Revision history

1. 2026-11-08 #19

   Neue Updates von Debian aufgenommen

2. 2026-09-30 #18

   Neue Updates von Oracle Linux aufgenommen

3. 2026-09-29 #17

   Neue Updates von Oracle Linux aufgenommen

4. 2026-09-28 #16

   Neue Updates aufgenommen

5. 2026-09-24 #15

   Neue Updates von openSUSE aufgenommen

6. 2026-09-13 #14

   Neue Updates von Gentoo aufgenommen

7. 2026-08-26 #13

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

8. 2026-08-16 #12

   Neue Updates von Oracle Linux aufgenommen

9. 2026-08-12 #11

   Neue Updates von Red Hat aufgenommen

10. 2026-08-11 #10

    Neue Updates von SUSE aufgenommen

11. 2026-08-10 #9

    Neue Updates von Oracle Linux aufgenommen

12. 2026-08-09 #8

    Neue Updates von Oracle Linux aufgenommen

13. 2026-08-04 #7

    Neue Updates von Red Hat aufgenommen

14. 2026-08-03 #6

    Neue Updates von Debian aufgenommen

15. 2026-07-29 #5

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

16. 2026-07-21 #4

    Neue Updates von IBM aufgenommen

17. 2026-07-19 #3

    Neue Updates von Oracle Linux und SUSE aufgenommen

18. 2026-07-16 #2

    Neue Updates von Ubuntu aufgenommen

19. 2026-07-15 #1

    Initiale Fassung

References

• Ruby Release Notes vom 2026-07-15
  https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released/
• GitHub Security Advisory GHSA-q2mw-fvj9-vvcw vom 2026-04-24
  https://github.com/advisories/GHSA-q2mw-fvj9-vvcw
• GitHub Security Advisory GHSA-vcgp-9326-pqcp vom 2026-04-24
  https://github.com/advisories/GHSA-vcgp-9326-pqcp
• GitHub Security Advisory GHSA-87pf-fpwv-p7m7 vom 2026-04-24
  https://github.com/advisories/GHSA-87pf-fpwv-p7m7
• GitHub Security Advisory GHSA-hm49-wcqc-g2xg vom 2026-04-24
  https://github.com/advisories/GHSA-hm49-wcqc-g2xg
• GitHub Security Advisory GHSA-75xq-5h9v-w6px vom 2026-04-24
  https://github.com/advisories/GHSA-75xq-5h9v-w6px
• GitHub Security Advisory GHSA-8p34-64r3-mwg8 vom 2026-06-09
  https://github.com/advisories/GHSA-8p34-64r3-mwg8
• GitHub Security Advisory GHSA-c4fp-cxrr-mj66 vom 2026-06-09
  https://github.com/advisories/GHSA-c4fp-cxrr-mj66
• GitHub Security Advisory GHSA-46q3-7gv7-qmgg vom 2026-06-09
  https://github.com/advisories/GHSA-46q3-7gv7-qmgg
• Ubuntu Security Notice USN-8556-1 vom 2026-07-16
  https://ubuntu.com/security/notices/USN-8556-1
• Oracle Linux Security Advisory ELSA-2026-33540 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-33540.html
• Oracle Linux Security Advisory ELSA-2026-20606 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-20606.html
• Oracle Linux Security Advisory ELSA-2026-33565 vom 2026-07-17
  http://linux.oracle.com/errata/ELSA-2026-33565.html
• SUSE Security Update SUSE-SU-2026:3090-1 vom 2026-07-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027599.html
• IBM Security Bulletin 7280602 vom 2026-07-21
  https://www.ibm.com/support/pages/node/7280602
• Rocky Linux Security Advisory RLSA-2026:33512 vom 2026-07-29
  https://errata.build.resf.org/RLSA-2026:33512
• Debian Security Advisory DLA-4716 vom 2026-08-04
  https://lists.debian.org/debian-lts-announce/2026/08/msg00006.html
• Red Hat Security Advisory RHSA-2026:50728 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:50728
• Oracle Linux Security Advisory ELSA-2026-50828 vom 2026-08-10
  https://linux.oracle.com/errata/ELSA-2026-50828.html
• Oracle Linux Security Advisory ELSA-2026-50728 vom 2026-08-10
  https://linux.oracle.com/errata/ELSA-2026-50728.html
• Oracle Linux Security Advisory ELSA-2026-50827 vom 2026-08-11
  http://linux.oracle.com/errata/ELSA-2026-50827.html
• Oracle Linux Security Advisory ELSA-2026-37397 vom 2026-08-11
  https://linux.oracle.com/errata/ELSA-2026-37397.html
• SUSE Security Update SUSE-SU-2026:3556-1 vom 2026-08-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028196.html
• Red Hat Security Advisory RHSA-2026:54391 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:54391
• Red Hat Security Advisory RHSA-2026:54393 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:54393
• Red Hat Security Advisory RHSA-2026:54416 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:54416
• Oracle Linux Security Advisory ELSA-2026-50778 vom 2026-08-15
  https://oss.oracle.com/pipermail/el-errata/2026-August/021590.html
• Oracle Linux Security Advisory ELSA-2026-50773 vom 2026-08-15
  https://oss.oracle.com/pipermail/el-errata/2026-August/021589.html
• Rocky Linux Security Advisory RLSA-2026:50828 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50828
• Rocky Linux Security Advisory RLSA-2026:50827 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50827
• Rocky Linux Security Advisory RLSA-2026:50778 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50778
• Rocky Linux Security Advisory RLSA-2026:50773 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50773
• Rocky Linux Security Advisory RLSA-2026:50728 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:50728
• Gentoo Linux Security Advisory GLSA-202609-03 vom 2026-09-13
  https://security.gentoo.org/glsa/202609-03
• openSUSE Security Update OPENSUSE-SU-2026:21878-1 vom 2026-09-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H5GSEWRBRK6T2WY5GOLRFYLYEV6CKJXW/
• HCL Security Bulletin vom 2026-09-29
  https://support.hcl-software.com/community?id=community_blog&sys_id=a2b881be47eb87109b17e55a516d4367
• Oracle Linux Security Advisory ELSA-2026-72484 vom 2026-09-29
  https://linux.oracle.com/errata/ELSA-2026-72484.html
• Oracle Linux Security Advisory ELSA-2026-72485 vom 2026-09-29
  https://linux.oracle.com/errata/ELSA-2026-72485.html
• Oracle Linux Security Advisory ELSA-2026-72285 vom 2026-09-30
  https://linux.oracle.com/errata/ELSA-2026-72285.html
• Oracle Linux Security Advisory ELSA-2026-72286 vom 2026-09-30
  https://linux.oracle.com/errata/ELSA-2026-72286.html
• Debian Security Advisory DSA-6614 vom 2026-11-07
  https://lists.debian.org/debian-security-announce/2026/msg00533.html