Threats Tagged 'cve-2026-42257'

Multiple security vulnerabilities have been identified and addressed in the Ruby 4.0 module for Red Hat Enterprise Linux 9. These include memory corruption via buffer overflow in Zlib::GzipReader, several arbitrary IMAP command injection flaws, and denial of service issues related to Net::IMAP. The update rebases Ruby 4.0 to the latest release and includes bug fixes and enhancements. The advisory rates the security impact as Important and provides updated packages for affected Red Hat Enterprise Linux 9 variants.

This Red Hat Security Advisory addresses multiple vulnerabilities in Ruby 3.3, including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through unvalidated input, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases Ruby 3.3 to the latest release and includes bug fixes and enhancements. The advisory affects Red Hat Enterprise Linux 9 and related variants. No CVSS scores are provided, but the vulnerabilities are rated as having a high security impact.

Multiple security vulnerabilities have been identified and fixed in Ruby as part of a Red Hat security advisory. These include memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service conditions in Net::IMAP. The advisory also includes bug fixes and enhancements, rebasing Ruby to the latest 3.3 release. The update is rated as important by Red Hat Product Security and affects Red Hat Enterprise Linux 10 and related products.

Red Hat has issued a security advisory for ruby4.0 addressing multiple vulnerabilities including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases ruby4.0 to the latest Ruby 4.0 release and includes bug fixes and enhancements. These vulnerabilities affect Red Hat Enterprise Linux 10 and related products. The advisory rates the security impact as Important and provides updated packages to remediate these issues.

Red Hat has issued a security advisory for the ruby:3.3 module in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including memory corruption via buffer overflow in Zlib::GzipReader, arbitrary IMAP command injection through various input validation flaws, and denial of service via malformed or large iteration count inputs in Net::IMAP. The update rebases Ruby 3.3 to the latest release, incorporating these security fixes along with bug fixes and enhancements.

This update includes the following RPMs: ruby3.3: * ruby3.3-3.3.10-23.4.hum1 (aarch64, x86_64) * ruby3.3-bundled-gems-3.3.10-23.4.hum1 (aarch64, x86_64) * ruby3.3-default-gems-3.3.10-23.4.hum1 (noarch) * ruby3.3-devel-3.3.10-23.4.hum1 (aarch64, x86_64) * ruby3.3-doc-3.3.10-23.4.hum1 (noarch) * ruby3.3-libs-3.3.10-23.4.hum1 (aarch64, x86_64) * rubygem3.3-bigdecimal-3.1.5-23.4.hum1 (aarch64, x86_64) * rubygem3.3-bundler-2.5.22-23.4.hum1 (noarch) * rubygem3.3-devel-3.5.22-23.4.hum1 (noarch) * rubygem3.3-io-console-0.7.1-23.4.hum1 (aarch64, x86_64) * rubygem3.3-irb-1.13.1-23.4.hum1 (noarch) * rubygem3.3-json-2.7.2-23.4.hum1 (aarch64, x86_64) * rubygem3.3-minitest-5.20.0-23.4.hum1 (noarch) * rubygem3.3-power_assert-2.0.3-23.4.hum1 (noarch) * rubygem3.3-psych-5.1.2-23.4.hum1 (aarch64, x86_64) * rubygem3.3-racc-1.7.3-23.4.hum1 (aarch64, x86_64) * rubygem3.3-rake-13.1.0-23.4.hum1 (noarch) * rubygem3.3-rbs-3.4.0-23.4.hum1 (aarch64, x86_64) * rubygem3.3-rdoc-6.6.3.1-23.4.hum1 (noarch) * rubygem3.3-rexml-3.4.4-23.4.hum1 (noarch) * rubygem3.3-rss-0.3.1-23.4.hum1 (noarch) * rubygem3.3-rubygems-3.5.22-23.4.hum1 (noarch) * rubygem3.3-test-unit-3.6.1-23.4.hum1 (noarch) * rubygem3.3-typeprof-0.21.9-23.4.hum1 (noarch) * ruby3.3-3.3.10-23.4.hum1.src (src) Security Fix(es): ruby3.3: * CVE-2026-47240 * CVE-2026-47241 * CVE-2026-47242

This update includes the following RPMs: ruby3.4: * ruby3.4-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-bundled-gems-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-default-gems-3.4.10-31.hum1 (noarch) * ruby3.4-devel-3.4.10-31.hum1 (aarch64, x86_64) * ruby3.4-doc-3.4.10-31.hum1 (noarch) * ruby3.4-libs-3.4.10-31.hum1 (aarch64, x86_64) * rubygem3.4-bigdecimal-3.1.8-31.hum1 (aarch64, x86_64) * rubygem3.4-bundler-2.6.9-31.hum1 (noarch) * rubygem3.4-devel-3.6.9-31.hum1 (noarch) * rubygem3.4-io-console-0.8.1-31.hum1 (aarch64, x86_64) * rubygem3.4-irb-1.14.3-31.hum1 (noarch) * rubygem3.4-json-2.9.1-31.hum1 (aarch64, x86_64) * rubygem3.4-minitest-5.25.4-31.hum1 (noarch) * rubygem3.4-power_assert-2.0.5-31.hum1 (noarch) * rubygem3.4-psych-5.2.2-31.hum1 (aarch64, x86_64) * rubygem3.4-racc-1.8.1-31.hum1 (aarch64, x86_64) * rubygem3.4-rake-13.2.1-31.hum1 (noarch) * rubygem3.4-rbs-3.8.0-31.hum1 (aarch64, x86_64) * rubygem3.4-rdoc-6.14.0-31.hum1 (noarch) * rubygem3.4-rexml-3.4.4-31.hum1 (noarch) * rubygem3.4-rss-0.3.1-31.hum1 (noarch) * rubygem3.4-rubygems-3.6.9-31.hum1 (noarch) * rubygem3.4-test-unit-3.6.7-31.hum1 (noarch) * rubygem3.4-typeprof-0.30.1-31.hum1 (noarch) * ruby3.4-3.4.10-31.hum1.src (src) Security Fix(es): ruby3.4: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256 * CVE-2026-47242

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.5-35.hum1 (noarch) * ruby4.0-devel-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.5-35.hum1 (noarch) * ruby4.0-libs-4.0.5-35.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-35.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.10-35.hum1 (noarch) * rubygem4.0-devel-4.0.10-35.hum1 (noarch) * rubygem4.0-io-console-0.8.2-35.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-35.hum1 (noarch) * rubygem4.0-json-2.18.0-35.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-35.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-35.hum1 (noarch) * rubygem4.0-psych-5.3.1-35.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-35.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-35.hum1 (noarch) * rubygem4.0-rbs-3.10.0-35.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.4-35.hum1 (noarch) * rubygem4.0-rexml-3.4.4-35.hum1 (noarch) * rubygem4.0-rss-0.3.2-35.hum1 (noarch) * rubygem4.0-rubygems-4.0.10-35.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-35.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-35.hum1 (noarch) * ruby4.0-4.0.5-35.hum1.src (src)

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.5-35.hum1 (noarch) * ruby4.0-devel-4.0.5-35.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.5-35.hum1 (noarch) * ruby4.0-libs-4.0.5-35.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-35.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.10-35.hum1 (noarch) * rubygem4.0-devel-4.0.10-35.hum1 (noarch) * rubygem4.0-io-console-0.8.2-35.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-35.hum1 (noarch) * rubygem4.0-json-2.18.0-35.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-35.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-35.hum1 (noarch) * rubygem4.0-psych-5.3.1-35.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-35.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-35.hum1 (noarch) * rubygem4.0-rbs-3.10.0-35.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.4-35.hum1 (noarch) * rubygem4.0-rexml-3.4.4-35.hum1 (noarch) * rubygem4.0-rss-0.3.2-35.hum1 (noarch) * rubygem4.0-rubygems-4.0.10-35.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-35.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-35.hum1 (noarch) * ruby4.0-4.0.5-35.hum1.src (src)

This update includes the following RPMs: ruby3.3: * ruby3.3-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-bundled-gems-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-default-gems-3.3.10-23.2.hum1 (noarch) * ruby3.3-devel-3.3.10-23.2.hum1 (aarch64, x86_64) * ruby3.3-doc-3.3.10-23.2.hum1 (noarch) * ruby3.3-libs-3.3.10-23.2.hum1 (aarch64, x86_64) * rubygem3.3-bigdecimal-3.1.5-23.2.hum1 (aarch64, x86_64) * rubygem3.3-bundler-2.5.22-23.2.hum1 (noarch) * rubygem3.3-devel-3.5.22-23.2.hum1 (noarch) * rubygem3.3-io-console-0.7.1-23.2.hum1 (aarch64, x86_64) * rubygem3.3-irb-1.13.1-23.2.hum1 (noarch) * rubygem3.3-json-2.7.2-23.2.hum1 (aarch64, x86_64) * rubygem3.3-minitest-5.20.0-23.2.hum1 (noarch) * rubygem3.3-power_assert-2.0.3-23.2.hum1 (noarch) * rubygem3.3-psych-5.1.2-23.2.hum1 (aarch64, x86_64) * rubygem3.3-racc-1.7.3-23.2.hum1 (aarch64, x86_64) * rubygem3.3-rake-13.1.0-23.2.hum1 (noarch) * rubygem3.3-rbs-3.4.0-23.2.hum1 (aarch64, x86_64) * rubygem3.3-rdoc-6.6.3.1-23.2.hum1 (noarch) * rubygem3.3-rexml-3.4.4-23.2.hum1 (noarch) * rubygem3.3-rss-0.3.1-23.2.hum1 (noarch) * rubygem3.3-rubygems-3.5.22-23.2.hum1 (noarch) * rubygem3.3-test-unit-3.6.1-23.2.hum1 (noarch) * rubygem3.3-typeprof-0.21.9-23.2.hum1 (noarch) * ruby3.3-3.3.10-23.2.hum1.src (src) Security Fix(es): ruby3.3: * CVE-2026-42245 * CVE-2026-42246 * CVE-2026-42256