security update for ruby

This security update for Ruby 3.3, provided by Red Hat and SUSE, fixes several vulnerabilities: CVE-2026-27820 (memory corruption via buffer overflow in Zlib::GzipReader), CVE-2026-42257 (arbitrary IMAP command injection via CRLF sequences), CVE-2026-42256 (denial of service via large iteration count in SCRAM authentication), CVE-2026-47240 (command injection via non-synchronizing literals), CVE-2026-47241 (denial of service via malformed IMAP command input), and CVE-2026-47242 (arbitrary IMAP command injection due to improper input validation). The update rebases Ruby 3.3 to the latest release and is distributed as part of Red Hat Enterprise Linux 9.8 and related variants. These vulnerabilities impact the Ruby interpreter and its bundled gems, specifically in the zlib and net-imap components.

Exploitation of these vulnerabilities could lead to memory corruption, arbitrary command injection in IMAP processing, and denial of service conditions. The memory corruption vulnerability (CVE-2026-27820) could potentially allow attackers to execute arbitrary code or cause crashes. The IMAP-related vulnerabilities allow injection of arbitrary IMAP commands or denial of service, which could disrupt mail processing or lead to unauthorized actions within IMAP sessions. The overall security impact is rated as Important by Red Hat, corresponding to a high severity level.

An official security update is available and should be applied to affected systems. The update rebases Ruby 3.3 to the latest release including all relevant fixes. Users should follow the vendor's instructions at https://access.redhat.com/articles/11258 to apply the update. No additional mitigation steps are indicated beyond applying the official patch. Patch status is confirmed by the vendor advisory.