https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:24:09.359640+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:20596 ALSA-2026:20596 — Important: ruby:4.0 security update 2026-10-03T04:24:09.377548+00:00

Affected: AlmaLinux:9: ruby, AlmaLinux:9: ruby-bundled-gems, AlmaLinux:9: ruby-default-gems, AlmaLinux:9: ruby-devel, AlmaLinux:9: ruby-doc, AlmaLinux:9: ruby-libs, AlmaLinux:9: rubygem-bigdecimal, AlmaLinux:9: rubygem-bundler, AlmaLinux:9: rubygem-io-console, AlmaLinux:9: rubygem-irb and 18 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2026-33210 Withdrawn: BELL-CVE-2026-33210 — CVE-2026-33210 does not affect BellSoft software 2026-10-03T04:24:09.377685+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/brew-krane-cve-2026-33210 BREW-krane-CVE-2026-33210 — Ruby JSON has a format string injection vulnerability 2026-10-03T04:24:09.377718+00:00

Affected: Homebrew: krane

### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-an55071 Withdrawn: CLEANSTART-2026-AN55071 — Security fixes in logstash-fips 9.2.4-r3 2026-10-03T04:24:09.377769+00:00

Withdrawn by the publisher.

Affected: CleanStart: logstash-fips

Package logstash-fips version 9.2.4-r3 fixes 2 vulnerabilities: CVE-2026-33210, ghsa-3m6g-2423-7cp3

 https://cve.radiocsirt.org/vuln/euvd-2026-357264 EUVD-2026-357264 2026-10-03T04:24:09.377806+00:00 EUVD-2026-357264 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33210 fkie_cve-2026-33210 2026-10-03T04:24:09.377827+00:00

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

 https://cve.radiocsirt.org/vuln/ghsa-3m6g-2423-7cp3 GHSA-3m6g-2423-7cp3 — Ruby JSON has a format string injection vulnerability 2026-10-03T04:24:09.377861+00:00

Affected: RubyGems: json

### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

 https://cve.radiocsirt.org/vuln/rhsa-2026:20596 RHSA-2026:20596 — Red Hat Security Advisory: ruby:4.0 security update 2026-10-03T04:24:09.377906+00:00

ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection erb: ERB: Arbitrary code execution via deserialization bypass

 https://cve.radiocsirt.org/vuln/rhsa-2026:57565 RHSA-2026:57565 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T04:24:09.377958+00:00

ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

 https://cve.radiocsirt.org/vuln/rlsa-2026:20606 RLSA-2026:20606 — Important: ruby4.0 security update 2026-10-03T04:24:09.378041+00:00

Affected: Rocky Linux:10: ruby4.0

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33210 UBUNTU-CVE-2026-33210 2026-10-03T04:24:09.378094+00:00

Affected: Ubuntu:14.04:LTS: ruby-json, Ubuntu:16.04:LTS: ruby-json, Ubuntu:18.04:LTS: ruby-json, Ubuntu:20.04:LTS: ruby-json, Ubuntu:22.04:LTS: ruby-json, Ubuntu:24.04:LTS: ruby-json, Ubuntu:25.10: ruby-json, Ubuntu:26.04:LTS: ruby-json

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.