Red Hat Product Security issued an important security update for the ruby:4.0 module in Red Hat Enterprise Linux 9 to address two vulnerabilities: CVE-2026-33210, a format string injection in ruby/json causing denial of service or information disclosure, and CVE-2026-41316, an arbitrary code execution vulnerability in ERB via deserialization bypass. The update rebases ruby:4.0 to the latest Ruby 4.0 release and is available for multiple RHEL 9 architectures. The advisory references Red Hat Bugzilla entries BZ-2449871 and BZ-2461369 for the respective CVEs. No CVSS score is provided in the advisory, but the severity is rated as Important by Red Hat.

The vulnerabilities could allow attackers to cause denial of service or disclose sensitive information through the JSON format string injection, and to execute arbitrary code via deserialization bypass in ERB. These impacts can compromise system confidentiality, integrity, and availability if exploited.

Red Hat has released an updated ruby:4.0 package for Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:20596 and the referenced article https://access.redhat.com/articles/11258. Since this is a traditional software package, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory.