Description
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ruby-lang | CGI | < 0.3.5.1, 0.3.6 – < 0.3.7, 0.4.0 – < 0.4.2 | 0.3.5.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | 3.3.7-2 | — |
| Debian 13 | ruby3.3 | 3.3.7-2 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
| Debian 11 | ruby2.7 | 2.7.4-1+deb11u5 | DLA-4082-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jruby | No fix yet | — |
| Ubuntu 26.04 LTS | jruby | No fix yet | — |
| Ubuntu 25.10 | jruby | No fix yet | — |
| Ubuntu 25.10 | ruby3.3 | 3.3.7-1ubuntu2 | — |
| Ubuntu 24.04 LTS | jruby | No fix yet | — |
| Ubuntu 24.04 LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.5 | USN-7418-1 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2.10 | USN-7418-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jruby | No fix yet | — |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.18 | USN-7418-1 |
| Ubuntu 18.04 LTS | jruby | No fix yet | — |
| Ubuntu 16.04 LTS | jruby | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby2.5 | 2.5.1-1ubuntu1.16+esm4 | USN-7442-1 |
| Ubuntu Pro 16.04 LTS | ruby2.3 | 2.3.1-2~ubuntu16.04.16+esm10 | USN-7442-1 |
| Ubuntu Pro 14.04 LTS | jruby | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | ruby +4 | 3.0.7-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | ruby-bundled-gems | 3.1.7-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4488 |
| RHEL 9 | rubygem-bigdecimal | 3.0.0-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-bundler | 2.2.33-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-io-console | 0.5.7-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-irb | 1.3.5-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-json | 2.5.1-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-minitest | 5.14.2-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-mysql2 +1 | 0.5.4-1.module+el9.1.0+15737+76195479 | RHSA-2025:4488 |
| RHEL 9 | rubygem-pg +1 | 1.3.5-1.module+el9.1.0+15737+76195479 | RHSA-2025:4488 |
| RHEL 9 | rubygem-power_assert | 1.2.1-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-psych | 3.3.2-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-rake | 13.0.3-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-rbs | 1.4.0-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-rdoc | 6.3.4.1-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-rexml | 3.2.5-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-rss | 0.2.9-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-test-unit | 3.3.7-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygem-typeprof | 0.15.2-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 9 | rubygems +1 | 3.2.33-165.el9_5 | RHSA-2025:4488, RHSA-2025:4487 |
| RHEL 8 | ruby +5 | 3.1.7-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-abrt +1 | 0.4.0-1.module+el8.10.0+21470+43ec8058 | RHSA-2025:4063 |
| RHEL 8 | rubygem-bigdecimal | 3.1.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-bundler | 2.3.27-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-io-console | 0.5.11-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-irb | 1.4.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-json | 2.6.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-minitest | 5.15.0-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-mysql2 +1 | 0.5.3-3.module+el8.10.0+21470+43ec8058 | RHSA-2025:4063 |
| RHEL 8 | rubygem-pg +1 | 1.3.2-1.module+el8.10.0+21470+43ec8058 | RHSA-2025:4063 |
| RHEL 8 | rubygem-power_assert | 2.0.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-psych | 4.0.4-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-rake | 13.0.6-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-rbs | 2.7.0-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-rdoc | 6.4.1.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-rexml | 3.3.9-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-rss | 0.3.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-test-unit | 3.5.3-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygem-typeprof | 0.21.3-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
| RHEL 8 | rubygems +1 | 3.3.27-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:4063 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux 9 | rubygem-pg +1 | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux 8 | ruby +5 | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-abrt | 0.4.0-1.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-bigdecimal | 3.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-bundler | 2.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-io-console | 0.5.11-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-irb | 1.4.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-json | 2.6.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-minitest | 5.15.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-mysql2 | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-mysql2-doc | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-pg | 1.3.2-1.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-pg-doc | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-power_assert | 2.0.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-psych | 4.0.4-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rake | 13.0.6-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rbs | 2.7.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rdoc | 6.4.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rexml | 3.3.9-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rss | 0.3.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-test-unit | 3.5.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-typeprof | 0.21.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux 8 | rubygems +1 | 3.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | ruby | 3.0.7-165.el9_5 | RLSA-2025:4488, RLSA-2025:4487 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.4-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4488 |
| Rocky Linux 9 | rubygem-pg | 1.3.5-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4488 |
| Rocky Linux 8 | ruby | 3.1.7-145.module+el8.10.0+1957+16e0d1a2 | RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-abrt | 0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-mysql2 | 0.5.3-3.module+el8.10.0+1744+6c504228 | RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-pg | 1.3.2-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:4063 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ruby2.5 | 2.5.9-150700.24.3.1 | SUSE-SU-2025:4264-1 |
| SLES 15 SP6 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLES 15 SP5 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLES 15 SP4 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLES 15 SP3 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLES for SAP 15 SP4 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLES for SAP 15 SP3 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLE HPC 15 SP5 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLE HPC 15 SP4 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SLE HPC 15 SP3 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SUSE Manager Server 4.3 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SUSE Manager Proxy 4.3 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
| SUSE Enterprise Storage 7.1 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | ruby2.5 | 2.5.9-150000.4.41.1 | SUSE-SU-2025:1369-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.2 +5 | 3.2.7-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-bigdecimal | 3.1.3-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-bundler | 2.4.19-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-io-console | 0.6.0-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-irb | 1.6.2-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-json | 2.6.3-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-minitest | 5.25.1-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-power_assert | 2.0.3-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-psych | 5.0.1-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-rake | 13.0.6-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-rbs | 2.8.2-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-rdoc | 6.5.1.1-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-rexml | 3.3.9-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-rss | 0.3.1-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-test-unit | 3.5.7-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygem-typeprof | 0.21.3-183.amzn2023.0.4 | ALAS2023-2025-929 |
| Amazon Linux 2023 | ruby3.2-rubygems +1 | 3.4.19-183.amzn2023.0.4 | ALAS2023-2025-929 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ruby | 3.3.5-3 | — |
| Azure Linux 2 (CBL-Mariner) | ruby | 3.1.4-9 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | ruby +4 | 3.0.7-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | ruby-bundled-gems | 3.1.7-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-bigdecimal | 3.0.0-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-bundler | 2.2.33-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-io-console | 0.5.7-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-irb | 1.3.5-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-json | 2.5.1-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-minitest | 5.14.2-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-mysql2 +1 | 0.5.4-1.module+el9.1.0+20815+286161bd | ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-pg +1 | 1.3.5-1.module+el9.1.0+20815+286161bd | ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-power_assert | 1.2.1-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-psych | 3.3.2-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-rake | 13.0.3-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-rbs | 1.4.0-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-rdoc | 6.3.4.1-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-rexml | 3.2.5-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-rss | 0.2.9-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-test-unit | 3.3.7-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygem-typeprof | 0.15.2-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 9 | rubygems +1 | 3.2.33-165.el9_5 | ELSA-2025-4488, ELSA-2025-4487 |
| Oracle Linux 8 | ruby +5 | 3.1.7-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-abrt +1 | 0.4.0-1.module+el8.7.0+20780+b11ff321 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-bigdecimal | 3.1.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-bundler | 2.3.27-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-io-console | 0.5.11-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-irb | 1.4.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-json | 2.6.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-minitest | 5.15.0-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-mysql2 +1 | 0.5.3-2.module+el8.7.0+20780+b11ff321 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-pg +1 | 1.3.2-1.module+el8.7.0+20780+b11ff321 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-power_assert | 2.0.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-psych | 4.0.4-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rake | 13.0.6-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rbs | 2.7.0-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rdoc | 6.4.1.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rexml | 3.3.9-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rss | 0.3.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-test-unit | 3.5.3-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-typeprof | 0.21.3-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
| Oracle Linux 8 | rubygems +1 | 3.3.27-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-4063 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jruby-9.4 +1 | 9.4.14.0-r0 | — |
| Wolfi rolling | ruby-3.1 +1 | 3.1.6-r12 | — |
| Wolfi rolling | ruby-3.2 +2 | 3.2.7-r1 | — |
| Wolfi rolling | ruby-3.3-base +2 | No fix yet | — |
| Wolfi rolling | ruby-3.4 +2 | 3.4.2-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | cgi | < 0.3.5.1 | 0.3.5.1 | GHSA-mhwm-jh88-3gjf |
| RubyGems | cgi | >= 0.3.6, < 0.3.7 | 0.3.7 | GHSA-mhwm-jh88-3gjf |
| RubyGems | cgi | >= 0.4.0, < 0.4.2 | 0.4.2 | GHSA-mhwm-jh88-3gjf |
Advisories 19
- ALSA-2025:4488 Moderate: ruby:3.1 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:4063 Moderate: ruby:3.1 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:4488 Red Hat Security Advisory: ruby:3.1 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:4063 Red Hat Security Advisory: ruby:3.1 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2025-0438 Ruby (CGI und URI gem): Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026
- RHSA-2025:4487 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- USN-7442-1 ruby2.3, ruby2.5 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7418-1 ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:4264-1 Security update for ruby2.5 SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4082-1 ruby2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:1369-1 Security update for ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:4487 Moderate: ruby security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:4063 Moderate: ruby:3.1 security update Rocky Linux Security Advisories · Jul 29, 2025
- RLSA-2025:4488 Moderate: ruby:3.1 security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-4487 Moderate: ruby security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 7, 2025
- ELSA-2025-4488 Moderate: ruby:3.1 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2025
- ELSA-2025-4063 Moderate: ruby:3.1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 22, 2025
- ALAS2023-2025-929 Moderate: ruby3.2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025