https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:44:05.154353+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:50728 ALSA-2026:50728 — Important: ruby:3.3 security, bug fix, and enhancement update 2026-10-03T23:44:05.770105+00:00

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2026-47242 BELL-CVE-2026-47242 2026-10-03T23:44:05.770288+00:00

Affected: Alpaquita:stream: ruby-net-imap

 https://cve.radiocsirt.org/vuln/brew-imap-backup-cve-2026-47242 BREW-imap-backup-CVE-2026-47242 — Net::IMAP: Command Injection via ID command argument 2026-10-03T23:44:05.770329+00:00

Affected: Homebrew: imap-backup

### Summary

Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.

Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.

### Details

When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.

While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.

### Impact

This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.

The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.

Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.

Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…

 https://cve.radiocsirt.org/vuln/cleanstart-2026-fp14746 CLEANSTART-2026-FP14746 — Security fix for CVE-2026-47242 applied in: logstash-fips 9.4.3-r1 2026-10-03T23:44:05.770400+00:00

Affected: CleanStart: logstash-fips

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-329171 EUVD-2026-329171 2026-10-03T23:44:05.770432+00:00 EUVD-2026-329171 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47242 fkie_cve-2026-47242 2026-10-03T23:44:05.770452+00:00

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.

 https://cve.radiocsirt.org/vuln/ghsa-46q3-7gv7-qmgg GHSA-46q3-7gv7-qmgg — Net::IMAP: Command Injection via ID command argument 2026-10-03T23:44:05.770490+00:00

Affected: RubyGems: net-imap

### Summary

Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.

Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.

### Details

When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.

While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.

### Impact

This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.

The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.

Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.

Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-47242 msrc_CVE-2026-47242 — Net::IMAP: Command Injection via ID command argument 2026-10-03T23:44:05.770553+00:00 msrc_CVE-2026-47242 https://cve.radiocsirt.org/vuln/oesa-2026-3536 OESA-2026-3536 — ruby security update 2026-10-03T23:44:05.770595+00:00

Affected: openEuler:24.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.(CVE-2025-24294)

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.(CVE-2026-27820)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::I…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21878-1 openSUSE-SU-2026:21878-1 — Security update for ruby3.4 2026-10-03T23:44:05.770664+00:00

Security update for ruby3.4

 https://cve.radiocsirt.org/vuln/rhsa-2026:33551 RHSA-2026:33551 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T23:44:05.770698+00:00

ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication net-imap: Net::IMAP: Command injection via non-synchronizing literals net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation

 https://cve.radiocsirt.org/vuln/rlsa-2026:50728 RLSA-2026:50728 — Important: ruby:3.3 security, bug fix, and enhancement update 2026-10-03T23:44:05.770740+00:00

Affected: Rocky Linux:8: ruby, Rocky Linux:8: rubygem-abrt, Rocky Linux:8: rubygem-mysql2, Rocky Linux:8: rubygem-pg

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)

* net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)

* ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)

* net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)

* net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)

* net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)

Bug Fix(es) and Enhancement(s):

* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47242 UBUNTU-CVE-2026-47242 2026-10-03T23:44:05.770810+00:00

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2379 WID-SEC-W-2026-2379 — Ruby: Mehrere Schwachstellen 2026-10-03T23:44:05.770877+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.