Description
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ruby-lang | URI | < 0.11.3, 0.12.0 – < 0.12.4, 0.13.0 – < 0.13.2, 1.0.0 – < 1.0.3 | 0.11.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | 3.3.7-2 | — |
| Debian 14 | rubygems | 3.6.6-1 | — |
| Debian 13 | ruby3.3 | 3.3.7-2 | — |
| Debian 13 | rubygems | 3.6.6-1 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
| Debian 12 | rubygems | 3.3.15-2+deb12u1 | — |
| Debian 11 | ruby2.7 | 2.7.4-1+deb11u5 | DLA-4082-1 |
| Debian 11 | rubygems | 3.2.5-2+deb11u1 | DLA-4163-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jruby | No fix yet | — |
| Ubuntu 26.04 LTS | jruby | No fix yet | — |
| Ubuntu 25.10 | jruby | No fix yet | — |
| Ubuntu 25.10 | ruby3.3 | 3.3.7-1ubuntu2 | — |
| Ubuntu 24.04 LTS | jruby | No fix yet | — |
| Ubuntu 24.04 LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.5 | USN-7418-1 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2.10 | USN-7418-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jruby | No fix yet | — |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.18 | USN-7418-1 |
| Ubuntu 18.04 LTS | jruby | No fix yet | — |
| Ubuntu 16.04 LTS | jruby | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby2.5 | 2.5.1-1ubuntu1.16+esm4 | USN-7442-1 |
| Ubuntu Pro 16.04 LTS | ruby2.3 | 2.3.1-2~ubuntu16.04.16+esm10 | USN-7442-1 |
| Ubuntu Pro 14.04 LTS | jruby | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ruby +5 | 3.3.8-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-bigdecimal | 3.1.5-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-bundler | 2.5.22-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-io-console | 0.7.1-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-irb | 1.13.1-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-json | 2.7.2-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-minitest | 5.20.0-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-power_assert | 2.0.3-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-psych | 5.1.2-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-racc | 1.7.3-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-rake | 13.1.0-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-rbs | 3.4.0-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-rdoc | 6.6.3.1-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-rexml | 3.3.9-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-rss | 0.3.1-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-test-unit | 3.6.1-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygem-typeprof | 0.21.9-10.el10_0 | RHSA-2025:8131 |
| RHEL 10 | rubygems +1 | 3.5.22-10.el10_0 | RHSA-2025:8131 |
| RHEL 9 | ruby +5 | 3.1.7-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-bigdecimal | 3.1.1-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-bundler | 2.3.27-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-io-console | 0.5.11-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-irb | 1.4.1-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-json | 2.6.1-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-minitest | 5.15.0-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-mysql2 +1 | 0.5.4-1.module+el9.1.0+15737+76195479 | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-pg +1 | 1.3.5-1.module+el9.1.0+15737+76195479 | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-power_assert | 2.0.1-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-psych | 4.0.4-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-racc | 1.7.3-4.module+el9.5.0+23030+26c9b8e1 | RHSA-2025:4493 |
| RHEL 9 | rubygem-rake | 13.0.6-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-rbs | 2.7.0-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-rdoc | 6.4.1.1-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-rexml | 3.3.9-4.module+el9.5.0+23030+26c9b8e1 | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-rss | 0.3.1-4.module+el9.5.0+23030+26c9b8e1 | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-test-unit | 3.5.3-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygem-typeprof | 0.21.3-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 9 | rubygems +1 | 3.3.27-146.module+el9.5.0+23003+a4c328ce | RHSA-2025:4493, RHSA-2025:4488 |
| RHEL 8 | ruby +5 | 3.1.7-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-abrt +1 | 0.4.0-1.module+el8.10.0+21226+b78a28c4 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-bigdecimal | 3.1.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-bundler | 2.3.27-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-io-console | 0.5.11-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-irb | 1.4.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-json | 2.6.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-minitest | 5.15.0-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-mysql2 +1 | 0.5.3-3.module+el8.10.0+21470+43ec8058 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-pg +1 | 1.3.2-1.module+el8.10.0+21470+43ec8058 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-power_assert | 2.0.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-psych | 4.0.4-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-racc | 1.7.3-4.module+el8.10.0+23024+a87ba659 | RHSA-2025:10217 |
| RHEL 8 | rubygem-rake | 13.0.6-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-rbs | 2.7.0-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-rdoc | 6.4.1.1-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-rexml | 3.3.9-4.module+el8.10.0+23024+a87ba659 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-rss | 0.3.1-4.module+el8.10.0+23024+a87ba659 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-test-unit | 3.5.3-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygem-typeprof | 0.21.3-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
| RHEL 8 | rubygems +1 | 3.3.27-145.module+el8.10.0+23011+f9d508f8 | RHSA-2025:10217, RHSA-2025:4063 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby-doc +1 | 3.3.8-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-bundler | 2.5.22-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-irb | 1.13.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-minitest | 5.20.0-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-power_assert | 2.0.3-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-rake | 13.1.0-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-rdoc | 6.6.3.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-rexml | 3.3.9-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-rss | 0.3.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-test-unit | 3.6.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygem-typeprof | 0.21.9-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 10 | rubygems +1 | 3.5.22-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux 9 | rubygem-pg +1 | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux 8 | ruby +5 | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-abrt | 0.4.0-1.module_el8.9.0+3746+91b8233a | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-bigdecimal | 3.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-bundler | 2.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-io-console | 0.5.11-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-irb | 1.4.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-json | 2.6.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-minitest | 5.15.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-mysql2 | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-mysql2-doc | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-pg | 1.3.2-1.module_el8.9.0+3746+91b8233a | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-pg-doc | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-power_assert | 2.0.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-psych | 4.0.4-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-racc | 1.7.3-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux 8 | rubygem-rake | 13.0.6-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rbs | 2.7.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rdoc | 6.4.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rexml | 3.3.9-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-rss | 0.3.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-test-unit | 3.5.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygem-typeprof | 0.21.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
| AlmaLinux 8 | rubygems +1 | 3.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:10217, ALSA-2025:4063 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby | 3.3.8-10.el10_0 | RLSA-2025:8131 |
| Rocky Linux 9 | ruby | 3.1.7-146.module+el9.5.0+31847+8b291b93 | RLSA-2025:4493, RLSA-2025:4488 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.4-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4493, RLSA-2025:4488 |
| Rocky Linux 9 | rubygem-pg | 1.3.5-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4493, RLSA-2025:4488 |
| Rocky Linux 8 | ruby | 3.1.7-145.module+el8.10.0+1957+16e0d1a2 | RLSA-2025:10217, RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-abrt | 0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2025:10217, RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-mysql2 | 0.5.3-3.module+el8.10.0+1744+6c504228 | RLSA-2025:10217, RLSA-2025:4063 |
| Rocky Linux 8 | rubygem-pg | 1.3.2-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:10217, RLSA-2025:4063 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ruby2.5 | 2.5.9-150700.24.3.1 | SUSE-SU-2025:4264-1 |
| SLES 15 SP6 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-1 |
| SLES 15 SP5 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLES 15 SP4 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLES 15 SP3 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLES for SAP 15 SP4 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLES for SAP 15 SP3 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLE HPC 15 SP5 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLE HPC 15 SP4 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SLE HPC 15 SP3 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SUSE Manager Server 4.3 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SUSE Manager Proxy 4.3 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
| SUSE Enterprise Storage 7.1 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | ruby2.5 | 2.5.9-150000.4.46.1 | SUSE-SU-2025:02739-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.2 +5 | 3.2.7-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-bigdecimal | 3.1.3-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-bundler | 2.4.19-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-io-console | 0.6.0-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-irb | 1.6.2-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-json | 2.6.3-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-minitest | 5.25.1-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-power_assert | 2.0.3-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-psych | 5.0.1-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-rake | 13.0.6-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-rbs | 2.8.2-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-rdoc | 6.5.1.1-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-rexml | 3.3.9-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-rss | 0.3.1-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-test-unit | 3.5.7-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygem-typeprof | 0.21.3-183.amzn2023.0.2 | ALAS2023-2025-928 |
| Amazon Linux 2023 | ruby3.2-rubygems +1 | 3.4.19-183.amzn2023.0.2 | ALAS2023-2025-928 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ruby | 3.3.5-3 | — |
| Azure Linux 2 (CBL-Mariner) | ruby | 3.1.4-9 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby +5 | 3.3.8-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-bigdecimal | 3.1.5-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-bundler | 2.5.22-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-io-console | 0.7.1-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-irb | 1.13.1-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-json | 2.7.2-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-minitest | 5.20.0-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-power_assert | 2.0.3-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-psych | 5.1.2-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-racc | 1.7.3-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-rake | 13.1.0-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-rbs | 3.4.0-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-rdoc | 6.6.3.1-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-rexml | 3.3.9-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-rss | 0.3.1-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-test-unit | 3.6.1-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygem-typeprof | 0.21.9-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 10 | rubygems +1 | 3.5.22-10.el10_0 | ELSA-2025-8131 |
| Oracle Linux 9 | ruby +5 | 3.1.7-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-bigdecimal | 3.1.1-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-bundler | 2.3.27-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-io-console | 0.5.11-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-irb | 1.4.1-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-json | 2.6.1-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-minitest | 5.15.0-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-mysql2 +1 | 0.5.4-1.module+el9.1.0+20815+286161bd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-pg +1 | 1.3.5-1.module+el9.1.0+20815+286161bd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-power_assert | 2.0.1-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-psych | 4.0.4-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-racc | 1.7.3-4.module+el9.5.0+90562+4bc8f111 | ELSA-2025-4493 |
| Oracle Linux 9 | rubygem-rake | 13.0.6-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-rbs | 2.7.0-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-rdoc | 6.4.1.1-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-rexml | 3.3.9-4.module+el9.5.0+90562+4bc8f111 | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-rss | 0.3.1-4.module+el9.5.0+90562+4bc8f111 | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-test-unit | 3.5.3-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygem-typeprof | 0.21.3-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 9 | rubygems +1 | 3.3.27-146.module+el9.5.0+90564+273a1edd | ELSA-2025-4493, ELSA-2025-4488 |
| Oracle Linux 8 | ruby +5 | 3.1.7-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-abrt +1 | 0.4.0-1.module+el8.7.0+20780+b11ff321 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-bigdecimal | 3.1.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-bundler | 2.3.27-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-io-console | 0.5.11-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-irb | 1.4.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-json | 2.6.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-minitest | 5.15.0-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-mysql2 +1 | 0.5.3-2.module+el8.7.0+20780+b11ff321 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-pg +1 | 1.3.2-1.module+el8.7.0+20780+b11ff321 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-power_assert | 2.0.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-psych | 4.0.4-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-racc | 1.7.3-4.module+el8.10.0+90625+b4030d02 | ELSA-2025-10217 |
| Oracle Linux 8 | rubygem-rake | 13.0.6-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rbs | 2.7.0-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rdoc | 6.4.1.1-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rexml | 3.3.9-4.module+el8.10.0+90625+b4030d02 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-rss | 0.3.1-4.module+el8.10.0+90625+b4030d02 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-test-unit | 3.5.3-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygem-typeprof | 0.21.3-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
| Oracle Linux 8 | rubygems +1 | 3.3.27-145.module+el8.10.0+90550+7d8a4a30 | ELSA-2025-10217, ELSA-2025-4063 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jruby-9.4 +1 | 9.4.14.0-r0 | — |
| Wolfi rolling | kube-fluentd-operator +3 | 1.18.2-r33 | — |
| Wolfi rolling | ruby-3.1 +1 | 3.1.6-r12 | — |
| Wolfi rolling | ruby-3.2 +2 | 3.2.7-r1 | — |
| Wolfi rolling | ruby-3.3-base +2 | No fix yet | — |
| Wolfi rolling | ruby-3.4 +2 | 3.4.2-r1 | — |
| Wolfi rolling | ruby3.2-uri +2 | 1.0.3-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | uri | < 0.11.3 | 0.11.3 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | >= 0.12.0, < 0.12.4 | 0.12.4 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | >= 0.13.0, < 0.13.2 | 0.13.2 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | >= 1.0.0, < 1.0.3 | 1.0.3 | GHSA-22h5-pq3x-2gf2 |
Advisories 28
- ALSA-2025:4488 Moderate: ruby:3.1 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8131 Moderate: ruby security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10217 Moderate: ruby:3.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:4063 Moderate: ruby:3.1 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:4488 Red Hat Security Advisory: ruby:3.1 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:4063 Red Hat Security Advisory: ruby:3.1 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-0438 Ruby (CGI und URI gem): Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026
- RHSA-2025:8131 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Sep 17, 2026
- RHSA-2025:4493 Red Hat Security Advisory: ruby:3.3 security update Red Hat Security Advisories (RHSA) · Sep 17, 2026
- RHSA-2025:10217 Red Hat Security Advisory: ruby:3.3 security update Red Hat Security Advisories (RHSA) · Sep 17, 2026
- USN-7442-1 ruby2.3, ruby2.5 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7418-1 ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:4264-1 Security update for ruby2.5 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02739-2 Security update for ruby2.5 SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4163-1 rubygems - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4082-1 ruby2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02739-1 Security update for ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:8131 Moderate: ruby security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:4493 Moderate: ruby:3.3 security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:10217 Moderate: ruby:3.3 security update Rocky Linux Security Advisories · Jul 29, 2025
- RLSA-2025:4063 Moderate: ruby:3.1 security update Rocky Linux Security Advisories · Jul 29, 2025
- RLSA-2025:4488 Moderate: ruby:3.1 security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-10217 Moderate: ruby:3.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 3, 2025
- ELSA-2025-8131 Moderate: ruby security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 27, 2025
- ELSA-2025-4493 Moderate: ruby:3.3 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2025
- ELSA-2025-4488 Moderate: ruby:3.1 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2025
- ELSA-2025-4063 Moderate: ruby:3.1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 22, 2025
- ALAS2023-2025-928 Moderate: ruby3.2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025