Red Hat Security Advisory: ruby security, bug fix, and enhancement update

This Red Hat security advisory addresses six vulnerabilities in Ruby and its components, notably in zlib and net-imap libraries. CVE-2026-27820 involves memory corruption due to a buffer overflow in Zlib::GzipReader. CVE-2026-42257 and CVE-2026-47242 describe arbitrary IMAP command injection vulnerabilities caused by improper input validation and CRLF injection sequences. CVE-2026-42256 and CVE-2026-47241 describe denial of service vulnerabilities in Net::IMAP via large iteration counts in SCRAM authentication and malformed command input, respectively. CVE-2026-47240 involves command injection via non-synchronizing literals in Net::IMAP. The advisory also includes a rebase to the latest Ruby 3.3 release and bug fixes. The update applies to Red Hat Enterprise Linux 10 and associated builder and extended support products.

The vulnerabilities could allow attackers to cause memory corruption, execute arbitrary IMAP commands, or cause denial of service conditions in applications using Ruby's zlib and net-imap libraries. This could lead to application crashes, unexpected behavior, or potential escalation depending on the context of use. The advisory rates the security impact as important, indicating significant risk if unpatched.

Red Hat has released an updated Ruby package for Red Hat Enterprise Linux 10 and related products that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:50778 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.