https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:23:09.859955+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:23062 ALSA-2025:23062 — Moderate: ruby:3.3 security update 2026-10-04T09:23:10.095338+00:00

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294) * rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2025-58767 BELL-CVE-2025-58767 2026-10-04T09:23:10.095549+00:00

Affected: Alpaquita:25: ruby-rexml, Alpaquita:stream: ruby-rexml

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0967 certfr-2025-avi-0967 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-04T09:23:10.095590+00:00 certfr-2025-avi-0967 https://cve.radiocsirt.org/vuln/cleanstart-2026-sz82695 CLEANSTART-2026-SZ82695 — Security fix for CVE-2025-58767 applied in: ruby 3.2.10-r0 2026-10-04T09:23:10.095621+00:00

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-252909 EUVD-2026-252909 2026-10-04T09:23:10.095657+00:00 EUVD-2026-252909 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58767 fkie_cve-2025-58767 2026-10-04T09:23:10.095678+00:00

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

 https://cve.radiocsirt.org/vuln/ghsa-c2f4-jgmc-q2r5 GHSA-c2f4-jgmc-q2r5 — REXML has DoS condition when parsing malformed XML file 2026-10-04T09:23:10.095720+00:00

Affected: RubyGems: rexml

### Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

### Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-58767 msrc_CVE-2025-58767 — REXML has a DoS condition when parsing malformed XML file 2026-10-04T09:23:10.095749+00:00 msrc_CVE-2025-58767 https://cve.radiocsirt.org/vuln/oesa-2025-2655 OESA-2025-2655 — ruby security update 2026-10-04T09:23:10.095767+00:00

Affected: openEuler:22.03-LTS-SP3: ruby, openEuler:22.03-LTS-SP4: ruby, openEuler:24.03-LTS: ruby, openEuler:24.03-LTS-SP1: ruby, openEuler:24.03-LTS-SP2: ruby, openEuler:20.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767)

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the `+` operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information.

**Note:** This vulnerability is a bypass of the fix to CVE-2025-27221.(CVE-2025-61594)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15828-1 openSUSE-SU-2025:15828-1 — libruby3_4-3_4-3.4.8-1.1 on GA media 2026-10-04T09:23:10.095801+00:00

libruby3_4-3_4-3.4.8-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:23140 RHSA-2025:23140 — Red Hat Security Advisory: ruby:3.3 security update 2026-10-04T09:23:10.095817+00:00

rexml: REXML denial of service

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58767 UBUNTU-CVE-2025-58767 2026-10-04T09:23:10.095832+00:00

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: ruby3.2, Ubuntu:25.10: ruby3.3, Ubuntu:26.04:LTS: ruby3.3

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2083 WID-SEC-W-2025-2083 — Ruby: Schwachstelle ermöglicht Denial of Service 2026-10-04T09:23:10.095858+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen.