Ruby

Products

Exploited and recent CVEs

• CVE-2026-80213 Medium 4.0 An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets h 0.3%
• CVE-2026-80212 High 7.5 An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class 0.4%
• CVE-2026-71847 High 8.7 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams 0.4%
• CVE-2026-54696 Low 3.7 Ruby JSON: JSON generator heap buffer overflow when streaming to an IO 0.4%
• CVE-2026-47242 Medium 5.8 Net::IMAP: Command Injection via ID command argument 0.2%
• CVE-2026-47240 Medium 5.8 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument 0.8%
• CVE-2026-47241 Low 2.1 Net::IMAP: Denial of Service via incomplete raw argument validation 0.4%
• CVE-2026-42258 High 7.1 net-imap: Command Injection via unvalidated Symbol inputs 0.8%
• CVE-2026-42257 Medium 5.8 net-imap: Command Injection via "raw" arguments to multiple commands 0.4%
• CVE-2026-42256 Medium 6.0 net-imap: Denial of service via high iteration count for `SCRAM-*` authentication 0.3%
• CVE-2026-42245 Low 2.3 net-imap: Quadratic complexity when reading response literals 0.4%
• CVE-2026-42246 High 7.4 net-imap vulnerable to STARTTLS stripping via invalid response timing 0.3%
• CVE-2026-41316 High 8.1 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class 1.1%
• CVE-2026-27820 Low 1.7 zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption 0.6%
• CVE-2026-33210 Critical 9.1 Ruby JSON has a format string injection vulnerability 0.9%
• CVE-2025-61594 Low 2.1 URI Credential Leakage Bypass over CVE-2025-27221 0.6%
• CVE-2025-58767 Low 1.2 REXML has a DoS condition when parsing malformed XML file 0.2%
• CVE-2025-24294 High 7.5 The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft 0.7%
• CVE-2025-6442 Medium 6.5 Ruby WEBrick read_header HTTP Request Smuggling Vulnerability 0.5%
• CVE-2025-43857 Medium 6.0 net-imap rubygem vulnerable to possible DoS by memory exhaustion 0.5%
• CVE-2025-27788 High 7.5 Ruby JSON Parser has Out-of-bounds Read 0.7%
• CVE-2025-25186 Medium 6.5 Net::IMAP vulnerable to possible DoS by memory exhaustion 0.6%
• CVE-2024-49761 Medium 6.6 REXML ReDoS vulnerability 1.4%
• CVE-2024-43398 Medium 5.9 REXML denial of service vulnerability 1.2%
• CVE-2024-41946 Medium 5.3 REXML DoS vulnerability 1.2%
• CVE-2024-41123 Medium 5.3 REXML DoS vulnerability 1.3%
• CVE-2024-39908 Medium 4.3 Denial of service in REXML 1.5%
• CVE-2024-35176 Medium 5.3 REXML contains a denial of service vulnerability 2.1%