Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

This advisory covers six security vulnerabilities in Ruby 3.3 as packaged by Red Hat for RHEL 8. The issues include CVE-2026-27820, a memory corruption vulnerability caused by a buffer overflow in Zlib::GzipReader; CVE-2026-42257 and CVE-2026-47242, arbitrary IMAP command injection vulnerabilities due to improper input validation and CRLF injection in Net::IMAP; CVE-2026-42256 and CVE-2026-47241, denial of service vulnerabilities via large iteration counts in SCRAM authentication and malformed command input in Net::IMAP; and CVE-2026-47240, command injection via non-synchronizing literals in Net::IMAP. The advisory also includes a rebase to the latest Ruby 3.3 release for RHEL 8. These vulnerabilities stem from issues such as buffer overflows, improper input validation, and command injection vectors in the Net::IMAP library.

Successful exploitation of these vulnerabilities could lead to memory corruption, arbitrary command injection on IMAP servers, and denial of service conditions. Memory corruption may allow attackers to execute arbitrary code or cause application crashes. Command injection vulnerabilities could allow attackers to execute arbitrary IMAP commands, potentially impacting confidentiality or integrity of IMAP sessions. Denial of service vulnerabilities could disrupt service availability by causing the Ruby IMAP client or server to become unresponsive or crash.

Red Hat has released an updated ruby:3.3 module for Red Hat Enterprise Linux 8 that includes fixes for all listed vulnerabilities. Users should apply this update promptly to remediate these issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is a traditional software package, remediation requires applying the vendor-provided update. No indication is given that these issues are already mitigated or require no action.