https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:28:16 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:50728 <p><strong>Affected:</strong> AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more</p> <p>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.</p> <p>Security Fix(es):</p> <p>* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more</p> <p>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.</p> <p>Security Fix(es):</p> <p>* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257) * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256) * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240) * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:50728 https://cve.radiocsirt.org/vuln/bell-cve-2026-47242 <p><strong>Affected:</strong> Alpaquita:stream: ruby-net-imap</p> <p><strong>Affected:</strong> Alpaquita:stream: ruby-net-imap</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-47242 https://cve.radiocsirt.org/vuln/brew-imap-backup-cve-2026-47242 <p><strong>Affected:</strong> Homebrew: imap-backup</p> <p>### Summary</p> <p>Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.</p> <p>Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.</p> <p>### Details</p> <p>When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.</p> <p>While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.</p> <p>### Impact</p> <p>This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.</p> <p>The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.</p> <p>Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.</p> <p>Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…</p> <p><strong>Affected:</strong> Homebrew: imap-backup</p> <p>### Summary</p> <p>Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.</p> <p>Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.</p> <p>### Details</p> <p>When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.</p> <p>While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.</p> <p>### Impact</p> <p>This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.</p> <p>The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.</p> <p>Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.</p> <p>Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…</p> https://cve.radiocsirt.org/vuln/brew-imap-backup-cve-2026-47242 https://cve.radiocsirt.org/vuln/cleanstart-2026-fp14746 <p><strong>Affected:</strong> CleanStart: logstash-fips</p> <p>Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: logstash-fips</p> <p>Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fp14746 https://cve.radiocsirt.org/vuln/euvd-2026-329171 EUVD-2026-329171 https://cve.radiocsirt.org/vuln/euvd-2026-329171 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47242 <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47242 https://cve.radiocsirt.org/vuln/ghsa-46q3-7gv7-qmgg <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary</p> <p>Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.</p> <p>Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.</p> <p>### Details</p> <p>When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.</p> <p>While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.</p> <p>### Impact</p> <p>This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.</p> <p>The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.</p> <p>Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.</p> <p>Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…</p> <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary</p> <p>Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.</p> <p>Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.</p> <p>### Details</p> <p>When `Net::IMAP#id` is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.</p> <p>While `Net::IMAP#enable` does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The `#to_s` value is sent verbatim.</p> <p>### Impact</p> <p>This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.</p> <p>The documentation for `#enable` explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for `#enable` will always be inappropriate.</p> <p>Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.</p> <p>Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command…</p> https://cve.radiocsirt.org/vuln/ghsa-46q3-7gv7-qmgg https://cve.radiocsirt.org/vuln/msrc_cve-2026-47242 msrc_CVE-2026-47242 https://cve.radiocsirt.org/vuln/msrc_cve-2026-47242 https://cve.radiocsirt.org/vuln/oesa-2026-3536 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: ruby</p> <p>Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):</p> <p>The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.</p> <p>An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.</p> <p>This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.(CVE-2025-24294)</p> <p>zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.(CVE-2026-27820)</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::I…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: ruby</p> <p>Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):</p> <p>The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.</p> <p>An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.</p> <p>This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.(CVE-2025-24294)</p> <p>zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.(CVE-2026-27820)</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::I…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3536 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21878-1 <p>Security update for ruby3.4</p> <p>Security update for ruby3.4</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21878-1 https://cve.radiocsirt.org/vuln/rhsa-2026:33551 <p>ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication net-imap: Net::IMAP: Command injection via non-synchronizing literals net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation</p> <p>ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication net-imap: Net::IMAP: Command injection via non-synchronizing literals net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:33551 https://cve.radiocsirt.org/vuln/rlsa-2026:50728 <p><strong>Affected:</strong> Rocky Linux:8: ruby, Rocky Linux:8: rubygem-abrt, Rocky Linux:8: rubygem-mysql2, Rocky Linux:8: rubygem-pg</p> <p>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.</p> <p>Security Fix(es):</p> <p>* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)</p> <p>* net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)</p> <p>* ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)</p> <p>* net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)</p> <p>* net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)</p> <p>* net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: ruby, Rocky Linux:8: rubygem-abrt, Rocky Linux:8: rubygem-mysql2, Rocky Linux:8: rubygem-pg</p> <p>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.</p> <p>Security Fix(es):</p> <p>* zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)</p> <p>* net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)</p> <p>* ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)</p> <p>* net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)</p> <p>* net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)</p> <p>* net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-8] (JIRA:Rocky Linux-170929)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:50728 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47242 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47242 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2379 <p>Ein Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2379