Most recent entries from all

ALSA-2025:23062 — Moderate: ruby:3.3 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294) * rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2025-58767

Affected: Alpaquita:25: ruby-rexml, Alpaquita:stream: ruby-rexml

certfr-2025-avi-0967 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0967

CLEANSTART-2026-SZ82695 — Security fix for CVE-2025-58767 applied in: ruby 3.2.10-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-252909

fkie_cve-2025-58767

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

GHSA-c2f4-jgmc-q2r5 — REXML has DoS condition when parsing malformed XML file

Affected: RubyGems: rexml

### Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

### Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

msrc_CVE-2025-58767 — REXML has a DoS condition when parsing malformed XML file

msrc_CVE-2025-58767

OESA-2025-2655 — ruby security update

Affected: openEuler:22.03-LTS-SP3: ruby, openEuler:22.03-LTS-SP4: ruby, openEuler:24.03-LTS: ruby, openEuler:24.03-LTS-SP1: ruby, openEuler:24.03-LTS-SP2: ruby, openEuler:20.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the `+` operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information.

**Note:** This vulnerability is a bypass of the fix to CVE-2025-27221.(CVE-2025-61594)

openSUSE-SU-2025:15828-1 — libruby3_4-3_4-3.4.8-1.1 on GA media

libruby3_4-3_4-3.4.8-1.1 on GA media

RHSA-2025:23140 — Red Hat Security Advisory: ruby:3.3 security update

rexml: REXML denial of service

UBUNTU-CVE-2025-58767

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: ruby3.2, Ubuntu:25.10: ruby3.3, Ubuntu:26.04:LTS: ruby3.3

WID-SEC-W-2025-2083 — Ruby: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen.