This security advisory from Red Hat Product Security covers vulnerabilities in ruby3.4 packages included in Red Hat Hardened Images RPMs. The advisory lists three CVEs (CVE-2026-42245, CVE-2026-42246, CVE-2026-42256) affecting ruby3.4 and its bundled gems. The vulnerabilities relate to CWE-606 (Uncheck Input for Loop Condition) and CWE-325 (Missing Required Cryptographic Step). The update provides new RPM versions (ruby3.4-3.4.8-31.2.hum1 and related packages) for aarch64 and x86_64 architectures. The advisory does not explicitly state fixed version ranges or detailed technical impact but indicates a high severity level. No known exploits in the wild have been reported. The vendor advisory directs users to apply the updated RPMs available via Red Hat Hardened Images.

The vulnerabilities affect ruby3.4 packages in Red Hat Hardened Images, potentially allowing issues related to unchecked loop conditions and missing cryptographic steps. These could lead to security weaknesses in applications relying on these Ruby packages. The advisory classifies the severity as high but does not provide specific exploit details or confirmed active exploitation. No known exploits in the wild have been reported, indicating limited or no active exploitation at this time.

Red Hat has released updated RPM packages for ruby3.4 and related gems as part of the Hardened Images update. Users should apply these updated packages (version 3.4.8-31.2.hum1) to remediate the vulnerabilities. The vendor advisory provides instructions and links for obtaining and applying the updates. Since this is not a cloud service, remediation is the responsibility of the system administrators. Patch status is confirmed by the vendor advisory indicating the availability of updated RPMs. There are no indications that no action is required or that the issue is already mitigated without updates.