Red Hat Security Advisory: ruby4.0 security, bug fix, and enhancement update

This advisory covers multiple security vulnerabilities in ruby4.0 as distributed by Red Hat. The key issues include a memory corruption vulnerability in Zlib::GzipReader (CVE-2026-27820) caused by a buffer overflow, several arbitrary IMAP command injection vulnerabilities via CRLF sequences, non-synchronizing literals, and improper input validation (CVE-2026-42257, CVE-2026-47240, CVE-2026-47242), and denial of service vulnerabilities in Net::IMAP due to large iteration counts in SCRAM authentication and malformed command input (CVE-2026-42256, CVE-2026-47241). The advisory also includes a rebase to the latest Ruby 4.0 release with bug fixes and enhancements. The update is available for Red Hat Enterprise Linux 10 and related variants. No CVSS scores are provided in the advisory, but the impact is rated as Important by Red Hat.

Successful exploitation of these vulnerabilities could lead to memory corruption, arbitrary command injection in IMAP sessions, and denial of service conditions. Memory corruption may allow attackers to cause application crashes or potentially execute arbitrary code. IMAP command injection vulnerabilities could allow attackers to manipulate IMAP commands, potentially impacting mail server interactions. Denial of service vulnerabilities could disrupt service availability by causing resource exhaustion or application crashes. The advisory does not report known exploits in the wild.

Red Hat has released updated ruby4.0 packages that address these vulnerabilities by rebasing to the latest Ruby 4.0 release and applying security fixes. Users should apply the provided updates for Red Hat Enterprise Linux 10 and related products as detailed in the Red Hat advisory RHSA-2026:50773. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.