This security advisory from Red Hat Product Security addresses vulnerabilities in the Red Hat Hardened Images RPMs, particularly affecting ruby4.0 packages and associated rubygems. The advisory includes updates to numerous ruby4.0 RPMs across architectures aarch64 and x86_64. The vulnerabilities are tracked under CVE-2026-42257 and CVE-2026-42258, with CWE-93 indicating a weakness related to improper control of code generation or execution. The advisory does not specify fixed versions or detailed patch information but provides updated RPM versions (e.g., ruby4.0-4.0.5-35.hum1). No known exploits in the wild are reported. The update is classified as a bug fix and enhancement update, implying remediation is included in the updated RPMs.

The vulnerabilities affect Red Hat Hardened Images RPMs, specifically ruby4.0 and related rubygem packages. CWE-93 suggests a risk of improper control of code generation or execution, which could potentially lead to security issues such as code injection or execution of unintended code. The advisory classifies the severity as high, indicating a significant risk if exploited. However, there are no known exploits in the wild at this time.

Red Hat has released updated RPM packages for ruby4.0 and related rubygems as part of this advisory. Users of Red Hat Hardened Images should apply these updates promptly to remediate the vulnerabilities. Detailed instructions and updated packages are available via Red Hat's official channels (https://images.redhat.com/ and https://access.redhat.com/errata/RHSA-2026:36978). Since this is not a cloud service, remediation requires manual update by system administrators. No additional mitigation steps are specified in the advisory.