https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:08:43.238626+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2021:2584 ALSA-2021:2584 — Moderate: ruby:2.7 security, bug fix, and enhancement update 2026-10-03T10:08:43.761015+00:00

Affected: AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bson, AlmaLinux:8: rubygem-bson-doc, AlmaLinux:8: rubygem-mongo, AlmaLinux:8: rubygem-mongo-doc, AlmaLinux:8: rubygem-mysql2, AlmaLinux:8: rubygem-mysql2-doc, AlmaLinux:8: rubygem-pg, AlmaLinux:8: rubygem-pg-doc

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: ruby (2.7.3). (BZ#1951999)

Security Fix(es):

* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Resolv::DNS: ruby:2.7/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1952000)

 https://cve.radiocsirt.org/vuln/bdu:2022-00302 bdu:2022-00302 2026-10-03T10:08:43.761128+00:00 bdu:2022-00302 https://cve.radiocsirt.org/vuln/bell-cve-2021-28965 Withdrawn: BELL-CVE-2021-28965 — CVE-2021-28965 does not affect BellSoft software 2026-10-03T10:08:43.761147+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-ruby-2021-28965 BIT-ruby-2021-28965 2026-10-03T10:08:43.761164+00:00

Affected: Bitnami: ruby

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

 https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2021-28965 BREW-asciidoctor-CVE-2021-28965 — REXML round-trip instability 2026-10-03T10:08:43.761185+00:00

Affected: Homebrew: asciidoctor

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

 https://cve.radiocsirt.org/vuln/certfr-2021-avi-267 certfr-2021-avi-267 — De multiples vulnérabilités ont été découvertes dans les produits Gitlab. Elles permettent à un attaquant de provoquer… 2026-10-03T10:08:43.761205+00:00 certfr-2021-avi-267 https://cve.radiocsirt.org/vuln/cleanstart-2026-bm82320 CLEANSTART-2026-BM82320 — Security fix for CVE-2021-28965 applied in: ruby 2.7.3-r0 2026-10-03T10:08:43.761220+00:00

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-26134 EUVD-2026-26134 2026-10-03T10:08:43.761238+00:00 EUVD-2026-26134 https://cve.radiocsirt.org/vuln/fkie_cve-2021-28965 fkie_cve-2021-28965 2026-10-03T10:08:43.761249+00:00

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

 https://cve.radiocsirt.org/vuln/ghsa-8cr8-4vfw-mr7h GHSA-8cr8-4vfw-mr7h — REXML round-trip instability 2026-10-03T10:08:43.761269+00:00

Affected: RubyGems: rexml

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

 https://cve.radiocsirt.org/vuln/gsd-2021-28965 gsd-2021-28965 2026-10-03T10:08:43.761287+00:00 gsd-2021-28965 https://cve.radiocsirt.org/vuln/msrc_cve-2021-28965 msrc_CVE-2021-28965 — The REXML gem before 3.2.5 in Ruby before 2.6.7 2.7.x before 2.7.3 and 3.x before 3.0.1 does not properly address XML r… 2026-10-03T10:08:43.761298+00:00 msrc_CVE-2021-28965 https://cve.radiocsirt.org/vuln/oesa-2021-1259 OESA-2021-1259 — ruby security update 2026-10-03T10:08:43.761315+00:00

Affected: openEuler:20.03-LTS-SP1: ruby

Security Fix(es): The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.(CVE-2021-28965)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:0607-1 openSUSE-SU-2021:0607-1 — Security update for ruby2.5 2026-10-03T10:08:43.761333+00:00

Security update for ruby2.5

 https://cve.radiocsirt.org/vuln/rhsa-2021:2104 RHSA-2021:2104 — Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update 2026-10-03T10:08:43.761349+00:00

ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML

 https://cve.radiocsirt.org/vuln/suse-su-2021:1280-1 SUSE-SU-2021:1280-1 — Security update for ruby2.5 2026-10-03T10:08:43.761376+00:00

Security update for ruby2.5

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-28965 UBUNTU-CVE-2021-28965 2026-10-03T10:08:43.761391+00:00

Affected: Ubuntu:16.04:LTS: ruby2.3, Ubuntu:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2462 WID-SEC-W-2023-2462 — Ruby: Mehrere Schwachstellen 2026-10-03T10:08:43.761412+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Dateien zu manipulieren.