https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:50:42.423543+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:50728 ALSA-2026:50728 — Important: ruby:3.3 security, bug fix, and enhancement update 2026-10-04T01:50:42.910784+00:00

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-06116 bdu:2026-06116 2026-10-04T01:50:42.910891+00:00 bdu:2026-06116 https://cve.radiocsirt.org/vuln/bell-cve-2026-27820 BELL-CVE-2026-27820 2026-10-04T01:50:42.910909+00:00

Affected: Alpaquita:23: ruby, Alpaquita:25: ruby, Alpaquita:stream: ruby

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0519 certfr-2026-avi-0519 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoque… 2026-10-04T01:50:42.910931+00:00 certfr-2026-avi-0519 https://cve.radiocsirt.org/vuln/euvd-2026-291779 EUVD-2026-291779 2026-10-04T01:50:42.910946+00:00 EUVD-2026-291779 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27820 fkie_cve-2026-27820 2026-10-04T01:50:42.910957+00:00

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-g857-hhfv-j68w GHSA-g857-hhfv-j68w — Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption 2026-10-04T01:50:42.910979+00:00

Affected: RubyGems: zlib

### Details

A buffer overflow vulnerability exists in `Zlib::GzipReader`.

The `zstream_buffer_ungets` function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.

### Recommended action

We recommend to update the `zlib` gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

* For Ruby 3.2 users: Update to zlib 3.0.1 * For Ruby 3.3 users: Update to zlib 3.1.2

You can use gem update zlib to update it. If you are using bundler, please add `gem "zlib", ">= 3.2.3"` to your Gemfile.

### Affected versions

zlib gem 3.2.2 or lower

### Credits

[calysteon](https://hackerone.com/calysteon)

### References

* https://hackerone.com/reports/3467067

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27820 msrc_CVE-2026-27820 — zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption 2026-10-04T01:50:42.911014+00:00 msrc_CVE-2026-27820 https://cve.radiocsirt.org/vuln/oesa-2026-3533 OESA-2026-3533 — ruby security update 2026-10-04T01:50:42.911032+00:00

Affected: openEuler:22.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.(CVE-2025-24294)

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.(CVE-2026-27820)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::I…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21878-1 openSUSE-SU-2026:21878-1 — Security update for ruby3.4 2026-10-04T01:50:42.911072+00:00

Security update for ruby3.4

 https://cve.radiocsirt.org/vuln/rhsa-2026:50773 RHSA-2026:50773 — Red Hat Security Advisory: ruby4.0 security, bug fix, and enhancement update 2026-10-04T01:50:42.911092+00:00

zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input net-imap: Net::IMAP: Command injection via non-synchronizing literals net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation

 https://cve.radiocsirt.org/vuln/rlsa-2026:50728 RLSA-2026:50728 — Important: ruby:3.3 security, bug fix, and enhancement update 2026-10-04T01:50:42.911115+00:00

Affected: Rocky Linux:8: ruby, Rocky Linux:8: rubygem-abrt, Rocky Linux:8: rubygem-mysql2, Rocky Linux:8: rubygem-pg

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

* net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

* ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

* net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

* net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

* net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27820 UBUNTU-CVE-2026-27820 2026-10-04T01:50:42.911154+00:00

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0595 WID-SEC-W-2026-0595 — Ruby: Schwachstelle ermöglicht Denial of Service 2026-10-04T01:50:42.911190+00:00

Ein lokaler Angreifer kann eine Schwachstelle in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen.