This advisory covers several vulnerabilities in Ruby as distributed by Red Hat. The most critical is CVE-2026-41316, an arbitrary code execution vulnerability in ERB caused by a deserialization bypass that allows attackers to execute code by exploiting untrusted data deserialization. Additional vulnerabilities include IMAP command injection via symbol arguments (CVE-2026-42258), denial of service via crafted IMAP responses (CVE-2026-42245), and information disclosure through man-in-the-middle attacks bypassing TLS (CVE-2026-42246). Red Hat has issued patches for these vulnerabilities in Ruby packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions. The advisory includes detailed CVSS scoring for CVE-2026-41316 with a base score of 8.1, indicating high severity.

Successful exploitation of CVE-2026-41316 can lead to arbitrary code execution without requiring privileges or user interaction, potentially compromising system integrity, confidentiality, and availability. The IMAP-related vulnerabilities can result in command injection, denial of service, or information disclosure, impacting the security of applications using Ruby's Net::IMAP library. These vulnerabilities collectively pose a high risk to affected systems if unpatched.

Red Hat has released official security updates that address these vulnerabilities. Users should apply the provided patches promptly by updating Ruby packages to the fixed versions as detailed in the Red Hat advisory RHSA-2026:33462. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official fixes.