CVEs we hold for Ruby

Records whose assigning authority named Ruby as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-85396rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefixrubyzip

CVE-2026-82455RubyGems before 4.0.13 Path Traversal via Symlink Resolutionruby rubygems

CVE-2026-80213no title heldRuby resolv

CVE-2026-80212no title heldRuby resolv

CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key…ruby json

CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionruby-concurrency concurrent-ruby

CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityruby-concurrency concurrent-ruby

CVE-2026-54904concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`ruby-concurrency concurrent-ruby

CVE-2026-54696Ruby JSON: JSON generator heap buffer overflow when streaming to an IOruby json

CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataruby-oauth oauth

CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to…ruby-oauth oauth2

CVE-2026-47242Net::IMAP: Command Injection via ID command argumentruby net-imap

CVE-2026-47241Net::IMAP: Denial of Service via incomplete raw argument validationruby net-imap

CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentruby net-imap

CVE-2026-46727no title heldruby-lang Ruby

CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsruby net-imap

CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsruby net-imap

CVE-2026-42256net-imap: Denial of service via high iteration count for `SCRAM-*` authenticationruby net-imap

CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingruby net-imap

CVE-2026-42245net-imap: Quadratic complexity when reading response literalsruby net-imap

CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_classruby erb

CVE-2026-33210Ruby JSON has a format string injection vulnerabilityruby json

CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionruby zlib

CVE-2026-12209RubyLouvre avalon Template Filter index.js prototype pollutionRubyLouvre avalon

CVE-2025-6442Ruby WEBrick read_header HTTP Request Smuggling VulnerabilityRuby WEBrick

CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-27221ruby uri

CVE-2025-58767REXML has a DoS condition when parsing malformed XML fileruby rexml

CVE-2025-54314no title heldrubyonrails Thor

CVE-2025-43857net-imap rubygem vulnerable to possible DoS by memory exhaustionruby net-imap

CVE-2025-27788Ruby JSON Parser has Out-of-bounds Readruby json

CVE-2025-27221no title heldruby-lang URI

CVE-2025-27220no title heldruby-lang CGI

CVE-2025-27219no title heldruby-lang CGI

CVE-2025-25186Net::IMAP vulnerable to possible DoS by memory exhaustionruby net-imap

CVE-2025-24294no title heldRuby resolv

CVE-2024-49761REXML ReDoS vulnerabilityruby rexml

CVE-2024-43398REXML denial of service vulnerabilityruby rexml

CVE-2024-41946REXML DoS vulnerabilityruby rexml

CVE-2024-41123REXML DoS vulnerabilityruby rexml

CVE-2024-39908Denial of service in REXMLruby rexml

CVE-2024-35221Denial of service when publishing a package on rubygems.orgrubygems rubygems.org

CVE-2024-35176REXML contains a denial of service vulnerabilityruby rexml

CVE-2024-21654rubygems.org MFA Bypass through password reset function could allow account takeoverrubygems rubygems.org

CVE-2023-40165Unauthorized gem replacement for full names ending in numbers on rubygems.orgrubygems rubygems.org

CVE-2023-1125Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDORUnknown Ruby Help Desk

CVE-2022-47318no title heldruby-git

CVE-2022-46648no title heldruby-git

CVE-2022-36073RubyGems allows creation of users with arbitrary unverified emailsrubygems rubygems.org

CVE-2022-29218Unauthorized takeover for new versions of some platform-specific gemsrubygems rubygems.org

CVE-2022-29176Unauthorized gem takeover for some gems on rubygems.orgrubygems rubygems.org

CVE-2021-43809Local Code Execution through Argument Injection via dash leading git url parameter in Gemfilerubygems

CVE-2020-10716no title heldn/a rubygem-foreman_ansible

CVE-2019-3881no title heldn/a rubygem-bundler

CVE-2018-3769no title heldruby gem

CVE-2017-2096no title heldRuby Programming Shounendan smalruby-editor

CVE-2016-2339no title heldRuby

CVE-2016-2337no title heldRuby; Tcl/Tk

CVE-2016-2336no title heldRuby

CVE-2015-1855no title heldRuby

CVE-2014-0241no title heldrubygem-hammer_cli_foreman

CVE-2014-0084no title heldrubygem-openshift-origin-node

CVE-2014-0083no title heldruby-net-ldap

CVE-2013-6461no title heldRuby Nokogiri gem

CVE-2013-6460no title heldRuby Nokogiri gem

CVE-2013-2095no title heldrubygem-openshift-origin-controller

CVE-2013-1945no title heldruby193

CVE-2012-6135no title heldruby-passenger

CVE-2011-3624no title heldRuby

68 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.