Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-42257 (GCVE-0-2026-42257)
Vulnerability from cvelistv5 – Published: 2026-05-09 19:39 – Updated: 2026-05-13 19:33
VLAI
EPSS
VEX
Title
net-imap: Command Injection via "raw" arguments to multiple commands
Summary
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 19:27 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ruby/net-imap/security/advisor… | x_refsource_CONFIRM |
| https://github.com/ruby/net-imap/releases/tag/v0.4.24 | x_refsource_MISC |
| https://github.com/ruby/net-imap/releases/tag/v0.5.14 | x_refsource_MISC |
| https://github.com/ruby/net-imap/releases/tag/v0.6.4 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T19:27:16.888782Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T19:33:13.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "net-imap",
"vendor": "ruby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.24"
},
{
"status": "affected",
"version": "\u003e= 0.5.0, \u003c 0.5.14"
},
{
"status": "affected",
"version": "\u003e= 0.6.0, \u003c 0.6.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T19:39:48.398Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"
},
{
"name": "https://github.com/ruby/net-imap/releases/tag/v0.4.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"
},
{
"name": "https://github.com/ruby/net-imap/releases/tag/v0.5.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"
},
{
"name": "https://github.com/ruby/net-imap/releases/tag/v0.6.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4"
}
],
"source": {
"advisory": "GHSA-hm49-wcqc-g2xg",
"discovery": "UNKNOWN"
},
"title": "net-imap: Command Injection via \"raw\" arguments to multiple commands"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42257",
"datePublished": "2026-05-09T19:39:48.398Z",
"dateReserved": "2026-04-26T11:53:27.704Z",
"dateUpdated": "2026-05-13T19:33:13.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-42257",
"date": "2026-09-15",
"epss": "0.00429",
"percentile": "0.36354"
},
"microsoft_vex": {
"current_release_date": "2026-05-19T01:39:48.000Z",
"cve": "CVE-2026-42257",
"id": "msrc_CVE-2026-42257",
"initial_release_date": "2026-05-02T00:00:00.000Z",
"product_status:known_not_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net-imap: Command Injection via \"raw\" arguments to multiple commands",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-42257.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-42257\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-09T20:16:28.463\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.\"},{\"lang\":\"es\",\"value\":\"Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de las versiones 0.4.24, 0.5.14 y 0.6.4, varios comandos de Net::IMAP aceptan un argumento de cadena sin procesar que se env\u00eda al servidor sin validaci\u00f3n ni escape. Si esta cadena se deriva de una entrada controlada por el usuario, puede contener secuencias CRLF, que un atacante puede usar para inyectar comandos IMAP arbitrarios. Este problema ha sido parcheado en las versiones 0.4.24, 0.5.14 y 0.6.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"ruby\",\"product\":\"net-imap\",\"versions\":[{\"version\":\"\u003c 0.4.24\",\"status\":\"affected\"},{\"version\":\"\u003e= 0.5.0, \u003c 0.5.14\",\"status\":\"affected\"},{\"version\":\"\u003e= 0.6.0, \u003c 0.6.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-13T19:27:16.888782Z\",\"id\":\"CVE-2026-42257\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"},{\"lang\":\"en\",\"value\":\"CWE-93\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:net\\\\:\\\\:imap:*:*:*:*:*:ruby:*:*\",\"versionEndExcluding\":\"0.4.24\",\"matchCriteriaId\":\"05DB8FF3-7546-470A-BBB4-4DCAEAD83D6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:net\\\\:\\\\:imap:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"0.5.0\",\"versionEndExcluding\":\"0.5.14\",\"matchCriteriaId\":\"2CCEB891-1D8F-4431-A79C-2A7560A84F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:net\\\\:\\\\:imap:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"0.6.0\",\"versionEndExcluding\":\"0.6.4\",\"matchCriteriaId\":\"9A6D1995-BFA3-490F-967D-252CA7BE2264\"}]}]}],\"references\":[{\"url\":\"https://github.com/ruby/net-imap/releases/tag/v0.4.24\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ruby/net-imap/releases/tag/v0.5.14\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ruby/net-imap/releases/tag/v0.6.4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-26T22:04:14+00:00",
"cve": "CVE-2026-42257",
"id": "CVE-2026-42257",
"initial_release_date": "2026-05-09T19:39:48.398000+00:00",
"product_status:fixed": "573",
"product_status:known_affected": "9",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42257.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "critical",
"current_release_date": "2026-08-06T01:22:19Z",
"cve": "CVE-2026-42257",
"id": "CVE-2026-42257",
"initial_release_date": "2026-06-17T02:18:24Z",
"product_status:recommended": "54",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-42257",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-42257.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42257\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-13T19:27:16.888782Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-13T19:33:08.202Z\"}}], \"cna\": {\"title\": \"net-imap: Command Injection via \\\"raw\\\" arguments to multiple commands\", \"source\": {\"advisory\": \"GHSA-hm49-wcqc-g2xg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"ruby\", \"product\": \"net-imap\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.4.24\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.5.0, \u003c 0.5.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.6.0, \u003c 0.6.4\"}]}], \"references\": [{\"url\": \"https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg\", \"name\": \"https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ruby/net-imap/releases/tag/v0.4.24\", \"name\": \"https://github.com/ruby/net-imap/releases/tag/v0.4.24\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ruby/net-imap/releases/tag/v0.5.14\", \"name\": \"https://github.com/ruby/net-imap/releases/tag/v0.5.14\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ruby/net-imap/releases/tag/v0.6.4\", \"name\": \"https://github.com/ruby/net-imap/releases/tag/v0.6.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-93\", \"description\": \"CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-09T19:39:48.398Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-42257\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-13T19:33:13.948Z\", \"dateReserved\": \"2026-04-26T11:53:27.704Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-09T19:39:48.398Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
alsa-2026:50728
Vulnerability from osv_almalinux
Published
2026-08-05 00:00
Modified
2026-09-14 08:29
Summary
Important: ruby:3.3 security, bug fix, and enhancement update
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
- zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
- ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
- net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
- net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)
Bug Fix(es) and Enhancement(s):
- ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby-bundled-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby-default-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "ruby-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-abrt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-abrt-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-bigdecimal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-bundler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.22-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-io-console"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.1-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-irb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.1-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-minitest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.20.0-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-mysql2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-mysql2-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-pg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-pg-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1.module_el8.10.0+3799+191214cc"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-power_assert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-psych"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-racc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-rake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.1.0-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-rbs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-rdoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.3.1-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.4-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-rss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.1-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-test-unit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygem-typeprof"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.9-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "rubygems-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-8.module_el8.10.0+4241+4264e34b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)\n * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)\n * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)\n * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)\n\n\nBug Fix(es) and Enhancement(s): \n\n * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-8] (JIRA:AlmaLinux-170929)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:50728",
"modified": "2026-09-14T08:29:46Z",
"published": "2026-08-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:50728"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-27820"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42256"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42257"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47240"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47241"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47242"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2459002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468494"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491519"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491523"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-50728.html"
}
],
"related": [
"CVE-2026-27820",
"CVE-2026-42257",
"CVE-2026-42256",
"CVE-2026-47240",
"CVE-2026-47242",
"CVE-2026-47241"
],
"summary": "Important: ruby:3.3 security, bug fix, and enhancement update"
}
alsa-2026:50773
Vulnerability from osv_almalinux
Published
2026-08-05 00:00
Modified
2026-09-14 08:24
Summary
Important: ruby4.0 security, bug fix, and enhancement update
Details
Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.
Security Fix(es):
- zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
- ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
- net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
- net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)
Bug Fix(es) and Enhancement(s):
- ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby4.0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-36.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby4.0-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-36.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby4.0-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-36.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby4.0-rubygem-mysql2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.7-36.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby4.0-rubygem-pg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.3-36.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. \n\nSecurity Fix(es): \n\n * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)\n * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)\n * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)\n * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)\n\n\nBug Fix(es) and Enhancement(s): \n\n * ruby4.0: Rebase to the latest Ruby 4.0 release [almalinux-10.2.z] (JIRA:AlmaLinux-211310)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:50773",
"modified": "2026-09-14T08:24:38Z",
"published": "2026-08-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:50773"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-27820"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42256"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42257"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47240"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47241"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47242"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2459002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468494"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491519"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491523"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-50773.html"
}
],
"related": [
"CVE-2026-27820",
"CVE-2026-42257",
"CVE-2026-42256",
"CVE-2026-47240",
"CVE-2026-47242",
"CVE-2026-47241"
],
"summary": "Important: ruby4.0 security, bug fix, and enhancement update"
}
alsa-2026:50778
Vulnerability from osv_almalinux
Published
2026-08-05 00:00
Modified
2026-09-14 08:29
Summary
Important: ruby security, bug fix, and enhancement update
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
- zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
- ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
- net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
- net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)
Bug Fix(es) and Enhancement(s):
- ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby-bundled-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby-default-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "ruby-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-bigdecimal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-bundler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.22-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-io-console"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.1-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-irb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.1-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-minitest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.20.0-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-power_assert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-psych"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-racc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-rake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.1.0-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-rbs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-rdoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.3.1-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.4-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-rss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.1-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-test-unit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygem-typeprof"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.9-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "rubygems-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-14.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)\n * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)\n * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)\n * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)\n\n\nBug Fix(es) and Enhancement(s): \n\n * ruby: Rebase to the latest Ruby 3.3 release [almalinux-10.2.z] (JIRA:AlmaLinux-211300)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:50778",
"modified": "2026-09-14T08:29:47Z",
"published": "2026-08-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:50778"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-27820"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42256"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42257"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47240"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47241"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47242"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2459002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468494"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491519"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491523"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-50778.html"
}
],
"related": [
"CVE-2026-27820",
"CVE-2026-42257",
"CVE-2026-42256",
"CVE-2026-47240",
"CVE-2026-47242",
"CVE-2026-47241"
],
"summary": "Important: ruby security, bug fix, and enhancement update"
}
alsa-2026:50827
Vulnerability from osv_almalinux
Published
2026-08-05 00:00
Modified
2026-09-01 08:41
Summary
Important: ruby:4.0 security, bug fix, and enhancement update
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
- zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
- ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
- net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
- net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)
Bug Fix(es) and Enhancement(s):
- ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [almalinux-9.8.z] (JIRA:AlmaLinux-211301)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-bundled-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-default-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.6-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-bigdecimal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-bundler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.16-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-io-console"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.2-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-irb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.0-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.18.0-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-minitest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.0-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-mysql2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.7-1.module_el9.8.0+232+50f6dd36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-mysql2-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.7-1.module_el9.8.0+232+50f6dd36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-pg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.3-1.module_el9.8.0+232+50f6dd36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-pg-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.3-1.module_el9.8.0+232+50f6dd36"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-power_assert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-psych"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-racc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.3.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rbs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rdoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.4-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.4-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.2-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-test-unit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.5-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-typeprof"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.31.1-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.16-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygems-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.16-34.module_el9.8.0+289+5a070f48"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)\n * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)\n * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)\n * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)\n\n\nBug Fix(es) and Enhancement(s): \n\n * ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [almalinux-9.8.z] (JIRA:AlmaLinux-211301)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:50827",
"modified": "2026-09-01T08:41:00Z",
"published": "2026-08-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:50827"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-27820"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42256"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42257"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47240"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47241"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47242"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2459002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468494"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491519"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491523"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-50827.html"
}
],
"related": [
"CVE-2026-27820",
"CVE-2026-42257",
"CVE-2026-42256",
"CVE-2026-47240",
"CVE-2026-47242",
"CVE-2026-47241"
],
"summary": "Important: ruby:4.0 security, bug fix, and enhancement update"
}
alsa-2026:50828
Vulnerability from osv_almalinux
Published
2026-08-05 00:00
Modified
2026-09-01 08:40
Summary
Important: ruby:3.3 security, bug fix, and enhancement update
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
- zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)
- ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)
- net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)
- net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)
- net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)
Bug Fix(es) and Enhancement(s):
- ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-9.8.z] (JIRA:AlmaLinux-171335)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-bundled-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-default-gems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "ruby-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.12-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-bigdecimal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.5-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-bundler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.22-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-io-console"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.1-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-irb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.1-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-minitest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.20.0-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-mysql2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5-3.module_el9.7.0+184+e2e36072"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-mysql2-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5-3.module_el9.7.0+184+e2e36072"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-pg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-2.module_el9.7.0+245+447713a2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-pg-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-2.module_el9.7.0+245+447713a2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-power_assert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-psych"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-racc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rake"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.1.0-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rbs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rdoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.3.1-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.4-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-rss"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.1-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-test-unit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygem-typeprof"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.9-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygems"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "rubygems-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.22-8.module_el9.8.0+288+22f1c9f2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input (CVE-2026-42257)\n * ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication (CVE-2026-42256)\n * net-imap: Net::IMAP: Command injection via non-synchronizing literals (CVE-2026-47240)\n * net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242)\n * net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input (CVE-2026-47241)\n\n\nBug Fix(es) and Enhancement(s): \n\n * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [almalinux-9.8.z] (JIRA:AlmaLinux-171335)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:50828",
"modified": "2026-09-01T08:40:03Z",
"published": "2026-08-05T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:50828"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-27820"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42256"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-42257"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47240"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47241"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-47242"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2459002"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468494"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2468500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491519"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2491523"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-50828.html"
}
],
"related": [
"CVE-2026-27820",
"CVE-2026-42257",
"CVE-2026-42256",
"CVE-2026-47240",
"CVE-2026-47242",
"CVE-2026-47241"
],
"summary": "Important: ruby:3.3 security, bug fix, and enhancement update"
}
CERTFR-2026-AVI-0958
Vulnerability from certfr_avis - Published: 2026-07-31 - Updated: 2026-07-31
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Db2 | Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions v4.8 à v5.3.x antérieures à v5.4 patch 3 | ||
| IBM | AIX | AIX versions 7.3.x sans le correctif de sécurité curl_fix11.tar | ||
| IBM | QRadar | QRadar Data Synchronization App versions antérieures à 4.0.0 | ||
| IBM | QRadar | QRadar Pulse App versions antérieures à 2.2.17 | ||
| IBM | WebSphere Application Server | WebSphere Application Server versions 9.0.x sans les correctifs de sécurité temporaires antérieures à 9.0.5.29 (disponibilité prévue pour le troisième trimestre 2026) | ||
| IBM | Sterling Control Center | Sterling Control Center versions 6.3.1.0 sans le correctif iFix10 | ||
| IBM | WebSphere Application Server | WebSphere Application Server versions 8.5.x sans les correctifs de sécurité temporaires antérieures à 8.5.5.31 (disponibilité prévue pour le troisième trimestre 2026) | ||
| IBM | Sterling Control Center | Sterling Control Center versions 6.4.2.0 sans le correctif iFix05 | ||
| IBM | Sterling | Sterling External Authentication Server versions 6.1.x antérieures à 6.1.1.4 GA | ||
| IBM | QRadar | QRadar SIEM versions 7.5.x antérieures à 7.5.0 UP15 IF05 | ||
| IBM | Sterling B2B Integrator | Sterling B2B Integrator et Sterling File Gateway versions 6.2.0.x antérieures à 6.2.0.6_1 | ||
| IBM | Sterling B2B Integrator | Sterling B2B Integrator et Sterling File Gateway versions 6.2.1.x antérieures à 6.2.1.2 | ||
| IBM | Sterling Control Center | Sterling Control Center versions 6.4.1.0 sans le correctif iFix04 | ||
| IBM | Sterling B2B Integrator | Sterling B2B Integrator et Sterling File Gateway versions 6.2.2.x antérieures à 6.2.2.1 | ||
| IBM | WebSphere Application Server | WebSphere Application Server Liberty versions antérieures à 26.0.0.9 (disponibilité prévue pour le troisième trimestre 2026) |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions v4.8 \u00e0 v5.3.x ant\u00e9rieures \u00e0 v5.4 patch 3",
"product": {
"name": "Db2",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "AIX versions 7.3.x sans le correctif de s\u00e9curit\u00e9 curl_fix11.tar",
"product": {
"name": "AIX",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Data Synchronization App versions ant\u00e9rieures \u00e0 4.0.0",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Pulse App versions ant\u00e9rieures \u00e0 2.2.17",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 9.0.x sans les correctifs de s\u00e9curit\u00e9 temporaires ant\u00e9rieures \u00e0 9.0.5.29 (disponibilit\u00e9 pr\u00e9vue pour le troisi\u00e8me trimestre 2026)",
"product": {
"name": "WebSphere Application Server",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Control Center versions 6.3.1.0 sans le correctif iFix10",
"product": {
"name": "Sterling Control Center",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server versions 8.5.x sans les correctifs de s\u00e9curit\u00e9 temporaires ant\u00e9rieures \u00e0 8.5.5.31 (disponibilit\u00e9 pr\u00e9vue pour le troisi\u00e8me trimestre 2026)",
"product": {
"name": "WebSphere Application Server",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Control Center versions 6.4.2.0 sans le correctif iFix05",
"product": {
"name": "Sterling Control Center",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling External Authentication Server versions 6.1.x ant\u00e9rieures \u00e0 6.1.1.4 GA",
"product": {
"name": "Sterling",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 UP15 IF05",
"product": {
"name": "QRadar",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.6_1",
"product": {
"name": "Sterling B2B Integrator",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.1.x ant\u00e9rieures \u00e0 6.2.1.2",
"product": {
"name": "Sterling B2B Integrator",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling Control Center versions 6.4.1.0 sans le correctif iFix04",
"product": {
"name": "Sterling Control Center",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Sterling B2B Integrator et Sterling File Gateway versions 6.2.2.x ant\u00e9rieures \u00e0 6.2.2.1",
"product": {
"name": "Sterling B2B Integrator",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere Application Server Liberty versions ant\u00e9rieures \u00e0 26.0.0.9 (disponibilit\u00e9 pr\u00e9vue pour le troisi\u00e8me trimestre 2026)",
"product": {
"name": "WebSphere Application Server",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"name": "CVE-2026-45505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45505"
},
{
"name": "CVE-2025-66199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66199"
},
{
"name": "CVE-2026-3449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3449"
},
{
"name": "CVE-2026-59871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59871"
},
{
"name": "CVE-2026-42588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42588"
},
{
"name": "CVE-2026-33845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33845"
},
{
"name": "CVE-2026-44025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44025"
},
{
"name": "CVE-2026-42253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42253"
},
{
"name": "CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"name": "CVE-2026-42041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
},
{
"name": "CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"name": "CVE-2026-41716",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
},
{
"name": "CVE-2026-16184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16184"
},
{
"name": "CVE-2026-15328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15328"
},
{
"name": "CVE-2025-15469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
},
{
"name": "CVE-2020-13956",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13956"
},
{
"name": "CVE-2025-47944",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47944"
},
{
"name": "CVE-2025-56200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-56200"
},
{
"name": "CVE-2026-59874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
},
{
"name": "CVE-2026-42258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42258"
},
{
"name": "CVE-2026-7769",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7769"
},
{
"name": "CVE-2026-30827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30827"
},
{
"name": "CVE-2026-22752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22752"
},
{
"name": "CVE-2026-39833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39833"
},
{
"name": "CVE-2025-22228",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22228"
},
{
"name": "CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"name": "CVE-2026-2391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2391"
},
{
"name": "CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"name": "CVE-2026-46605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46605"
},
{
"name": "CVE-2026-22013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22013"
},
{
"name": "CVE-2026-53655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53655"
},
{
"name": "CVE-2026-29145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
},
{
"name": "CVE-2026-22018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22018"
},
{
"name": "CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"name": "CVE-2020-13955",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13955"
},
{
"name": "CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"name": "CVE-2026-41988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41988"
},
{
"name": "CVE-2026-14528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14528"
},
{
"name": "CVE-2026-6357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6357"
},
{
"name": "CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"name": "CVE-2026-2006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
},
{
"name": "CVE-2026-53550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53550"
},
{
"name": "CVE-2026-41721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
},
{
"name": "CVE-2026-54905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54905"
},
{
"name": "CVE-2026-0994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0994"
},
{
"name": "CVE-2026-49157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49157"
},
{
"name": "CVE-2021-47154",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-47154"
},
{
"name": "CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"name": "CVE-2026-54899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54899"
},
{
"name": "CVE-2026-39834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39834"
},
{
"name": "CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"name": "CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"name": "CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"name": "CVE-2026-54901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54901"
},
{
"name": "CVE-2026-42036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42036"
},
{
"name": "CVE-2026-2005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
},
{
"name": "CVE-2022-39135",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39135"
},
{
"name": "CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"name": "CVE-2026-33558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33558"
},
{
"name": "CVE-2026-33846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33846"
},
{
"name": "CVE-2021-23337",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
},
{
"name": "CVE-2026-5758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5758"
},
{
"name": "CVE-2026-34500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34500"
},
{
"name": "CVE-2026-54502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54502"
},
{
"name": "CVE-2026-22795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
},
{
"name": "CVE-2026-29146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
},
{
"name": "CVE-2026-34043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34043"
},
{
"name": "CVE-2025-64718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64718"
},
{
"name": "CVE-2026-9277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
},
{
"name": "CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"name": "CVE-2025-62718",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
},
{
"name": "CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"name": "CVE-2026-10536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10536"
},
{
"name": "CVE-2026-41844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41844"
},
{
"name": "CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"name": "CVE-2026-4424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
},
{
"name": "CVE-2026-45292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45292"
},
{
"name": "CVE-2024-38820",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38820"
},
{
"name": "CVE-2026-40356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40356"
},
{
"name": "CVE-2026-15325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15325"
},
{
"name": "CVE-2026-14976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14976"
},
{
"name": "CVE-2026-5598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
},
{
"name": "CVE-2026-42256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42256"
},
{
"name": "CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"name": "CVE-2025-59375",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59375"
},
{
"name": "CVE-2026-54906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54906"
},
{
"name": "CVE-2026-34040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34040"
},
{
"name": "CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"name": "CVE-2026-41842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41842"
},
{
"name": "CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"name": "CVE-2026-41695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
},
{
"name": "CVE-2026-14512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14512"
},
{
"name": "CVE-2026-11856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11856"
},
{
"name": "CVE-2026-44160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44160"
},
{
"name": "CVE-2026-42009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42009"
},
{
"name": "CVE-2026-33750",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33750"
},
{
"name": "CVE-2026-5038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5038"
},
{
"name": "CVE-2026-34478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34478"
},
{
"name": "CVE-2026-2359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2359"
},
{
"name": "CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"name": "CVE-2025-11143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11143"
},
{
"name": "CVE-2026-34480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
},
{
"name": "CVE-2026-59869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
},
{
"name": "CVE-2025-7783",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7783"
},
{
"name": "CVE-2025-12758",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12758"
},
{
"name": "CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"name": "CVE-2026-5079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5079"
},
{
"name": "CVE-2026-5795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5795"
},
{
"name": "CVE-2024-23953",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23953"
},
{
"name": "CVE-2025-68161",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
},
{
"name": "CVE-2026-44930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44930"
},
{
"name": "CVE-2026-14974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14974"
},
{
"name": "CVE-2024-29869",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29869"
},
{
"name": "CVE-2026-42010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42010"
},
{
"name": "CVE-2026-42506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42506"
},
{
"name": "CVE-2026-34479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34479"
},
{
"name": "CVE-2026-22796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
},
{
"name": "CVE-2026-26960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
},
{
"name": "CVE-2026-42040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42040"
},
{
"name": "CVE-2026-4867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4867"
},
{
"name": "CVE-2026-2303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2303"
},
{
"name": "CVE-2024-6763",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
},
{
"name": "CVE-2026-27903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27903"
},
{
"name": "CVE-2026-14981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14981"
},
{
"name": "CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"name": "CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"name": "CVE-2026-8924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
},
{
"name": "CVE-2024-45337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
},
{
"name": "CVE-2026-14529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14529"
},
{
"name": "CVE-2026-59875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59875"
},
{
"name": "CVE-2026-41843",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41843"
},
{
"name": "CVE-2026-54896",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54896"
},
{
"name": "CVE-2026-25680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25680"
},
{
"name": "CVE-2026-34487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
},
{
"name": "CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"name": "CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"name": "CVE-2026-41850",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41850"
},
{
"name": "CVE-2026-4519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
},
{
"name": "CVE-2026-34197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34197"
},
{
"name": "CVE-2024-12905",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12905"
},
{
"name": "CVE-2024-52046",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52046"
},
{
"name": "CVE-2026-59873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
},
{
"name": "CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"name": "CVE-2025-47935",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47935"
},
{
"name": "CVE-2026-40198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40198"
},
{
"name": "CVE-2026-4111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
},
{
"name": "CVE-2024-38827",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38827"
},
{
"name": "CVE-2026-41694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
},
{
"name": "CVE-2026-23950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
},
{
"name": "CVE-2026-40046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40046"
},
{
"name": "CVE-2022-22968",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22968"
},
{
"name": "CVE-2026-16192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16192"
},
{
"name": "CVE-2026-2950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
},
{
"name": "CVE-2026-54500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54500"
},
{
"name": "CVE-2026-3304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3304"
},
{
"name": "CVE-2026-40895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
},
{
"name": "CVE-2018-10237",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10237"
},
{
"name": "CVE-2026-14515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14515"
},
{
"name": "CVE-2026-22016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22016"
},
{
"name": "CVE-2026-22021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22021"
},
{
"name": "CVE-2026-6100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
},
{
"name": "CVE-2026-54904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54904"
},
{
"name": "CVE-2026-22007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22007"
},
{
"name": "CVE-2025-68160",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
},
{
"name": "CVE-2026-13149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
},
{
"name": "CVE-2026-54897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54897"
},
{
"name": "CVE-2026-34268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34268"
},
{
"name": "CVE-2026-41852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41852"
},
{
"name": "CVE-2021-22569",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22569"
},
{
"name": "CVE-2026-3520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3520"
},
{
"name": "CVE-2026-29786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29786"
},
{
"name": "CVE-2026-41006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41006"
},
{
"name": "CVE-2026-41711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
},
{
"name": "CVE-2026-27830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27830"
},
{
"name": "CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"name": "CVE-2026-2482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2482"
},
{
"name": "CVE-2026-42038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42038"
},
{
"name": "CVE-2026-49844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49844"
},
{
"name": "CVE-2026-25854",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25854"
},
{
"name": "CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"name": "CVE-2026-41851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41851"
},
{
"name": "CVE-2026-42039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
},
{
"name": "CVE-2026-8149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8149"
},
{
"name": "CVE-2026-6009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6009"
},
{
"name": "CVE-2026-9358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9358"
},
{
"name": "CVE-2026-14446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14446"
},
{
"name": "CVE-2026-42502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
},
{
"name": "CVE-2020-8908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8908"
},
{
"name": "CVE-2026-42245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42245"
},
{
"name": "CVE-2026-8723",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8723"
},
{
"name": "CVE-2026-40988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
},
{
"name": "CVE-2026-41841",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41841"
},
{
"name": "CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"name": "CVE-2025-69418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
},
{
"name": "CVE-2026-54903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54903"
},
{
"name": "CVE-2026-39304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39304"
},
{
"name": "CVE-2026-49270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49270"
},
{
"name": "CVE-2025-15468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
},
{
"name": "CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"name": "CVE-2026-15064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15064"
},
{
"name": "CVE-2026-42044",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
},
{
"name": "CVE-2026-54900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54900"
},
{
"name": "CVE-2018-16487",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16487"
},
{
"name": "CVE-2023-22899",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22899"
},
{
"name": "CVE-2026-42034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42034"
},
{
"name": "CVE-2026-8927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
},
{
"name": "CVE-2026-41846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41846"
},
{
"name": "CVE-2025-5889",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5889"
},
{
"name": "CVE-2026-41035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41035"
},
{
"name": "CVE-2026-40199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40199"
},
{
"name": "CVE-2025-27789",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27789"
},
{
"name": "CVE-2026-46598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46598"
},
{
"name": "CVE-2026-44024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44024"
},
{
"name": "CVE-2026-42246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42246"
},
{
"name": "CVE-2025-66566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66566"
},
{
"name": "CVE-2025-66168",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66168"
},
{
"name": "CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"name": "CVE-2025-11187",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11187"
},
{
"name": "CVE-2026-14980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14980"
},
{
"name": "CVE-2026-54898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54898"
},
{
"name": "CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"name": "CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"name": "CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"name": "CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"name": "CVE-2026-33227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33227"
},
{
"name": "CVE-2026-42264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
},
{
"name": "CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"name": "CVE-2026-44161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44161"
},
{
"name": "CVE-2026-4786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
},
{
"name": "CVE-2025-64756",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64756"
},
{
"name": "CVE-2026-34483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
},
{
"name": "CVE-2026-44496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
},
{
"name": "CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"name": "CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"name": "CVE-2025-48997",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48997"
},
{
"name": "CVE-2026-24880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
},
{
"name": "CVE-2021-22570",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-22570"
},
{
"name": "CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"name": "CVE-2026-41007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41007"
},
{
"name": "CVE-2026-42037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42037"
},
{
"name": "CVE-2026-2004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
},
{
"name": "CVE-2026-42042",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42042"
},
{
"name": "CVE-2025-21502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21502"
},
{
"name": "CVE-2026-35554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35554"
},
{
"name": "CVE-2025-48387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48387"
},
{
"name": "CVE-2026-12590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12590"
},
{
"name": "CVE-2026-27727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27727"
},
{
"name": "CVE-2026-34477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
},
{
"name": "CVE-2026-54902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54902"
},
{
"name": "CVE-2026-44490",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44490"
},
{
"name": "CVE-2026-54592",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54592"
},
{
"name": "CVE-2023-5752",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5752"
},
{
"name": "CVE-2026-39827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39827"
},
{
"name": "CVE-2025-12183",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12183"
},
{
"name": "CVE-2025-7338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7338"
},
{
"name": "CVE-2026-15280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15280"
},
{
"name": "CVE-2026-41848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41848"
},
{
"name": "CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"name": "CVE-2026-31802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31802"
},
{
"name": "CVE-2025-13465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
},
{
"name": "CVE-2026-13311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13311"
},
{
"name": "CVE-2026-41907",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41907"
},
{
"name": "CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"name": "CVE-2025-59343",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59343"
},
{
"name": "CVE-2026-34481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34481"
},
{
"name": "CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"name": "CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"name": "CVE-2026-42257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42257"
},
{
"name": "CVE-2026-42338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42338"
}
],
"initial_release_date": "2026-07-31T00:00:00",
"last_revision_date": "2026-07-31T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0958",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-31T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281450",
"url": "https://www.ibm.com/support/pages/node/7281450"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281625",
"url": "https://www.ibm.com/support/pages/node/7281625"
},
{
"published_at": "2026-07-30",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281949",
"url": "https://www.ibm.com/support/pages/node/7281949"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7277692",
"url": "https://www.ibm.com/support/pages/node/7277692"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281628",
"url": "https://www.ibm.com/support/pages/node/7281628"
},
{
"published_at": "2026-07-24",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281135",
"url": "https://www.ibm.com/support/pages/node/7281135"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281375",
"url": "https://www.ibm.com/support/pages/node/7281375"
},
{
"published_at": "2026-07-29",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281743",
"url": "https://www.ibm.com/support/pages/node/7281743"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281373",
"url": "https://www.ibm.com/support/pages/node/7281373"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281388",
"url": "https://www.ibm.com/support/pages/node/7281388"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281721",
"url": "https://www.ibm.com/support/pages/node/7281721"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281369",
"url": "https://www.ibm.com/support/pages/node/7281369"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281648",
"url": "https://www.ibm.com/support/pages/node/7281648"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281374",
"url": "https://www.ibm.com/support/pages/node/7281374"
},
{
"published_at": "2026-07-24",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281136",
"url": "https://www.ibm.com/support/pages/node/7281136"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281641",
"url": "https://www.ibm.com/support/pages/node/7281641"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281631",
"url": "https://www.ibm.com/support/pages/node/7281631"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281371",
"url": "https://www.ibm.com/support/pages/node/7281371"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281633",
"url": "https://www.ibm.com/support/pages/node/7281633"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281438",
"url": "https://www.ibm.com/support/pages/node/7281438"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281370",
"url": "https://www.ibm.com/support/pages/node/7281370"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281565",
"url": "https://www.ibm.com/support/pages/node/7281565"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281368",
"url": "https://www.ibm.com/support/pages/node/7281368"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281350",
"url": "https://www.ibm.com/support/pages/node/7281350"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281651",
"url": "https://www.ibm.com/support/pages/node/7281651"
},
{
"published_at": "2026-07-30",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281950",
"url": "https://www.ibm.com/support/pages/node/7281950"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281567",
"url": "https://www.ibm.com/support/pages/node/7281567"
},
{
"published_at": "2026-07-23",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7280950",
"url": "https://www.ibm.com/support/pages/node/7280950"
},
{
"published_at": "2026-07-27",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281441",
"url": "https://www.ibm.com/support/pages/node/7281441"
},
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7281649",
"url": "https://www.ibm.com/support/pages/node/7281649"
}
]
}
cleanstart-2026-rg00675
Vulnerability from cleanstart
Published
2026-07-21 08:32
Modified
2026-07-03 09:44
Summary
Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2
Details
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "ruby-fluentd-1.19"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.2-r2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-RG00675",
"modified": "2026-07-03T09:44:40Z",
"published": "2026-07-21T08:32:31.820114Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RG00675.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33637"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42245"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42246"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42256"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42257"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42258"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5rv5-xj5j-3484"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-75xq-5h9v-w6px"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-87pf-fpwv-p7m7"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-hm49-wcqc-g2xg"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-q2mw-fvj9-vvcw"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vcgp-9326-pqcp"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33637"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42245"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42246"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42256"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42257"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42258"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa-5rv5-xj5j-3484, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp applied in versions: 1.19.2-r2",
"upstream": [
"CVE-2026-33637",
"CVE-2026-42245",
"CVE-2026-42246",
"CVE-2026-42256",
"CVE-2026-42257",
"CVE-2026-42258",
"ghsa-5rv5-xj5j-3484",
"ghsa-75xq-5h9v-w6px",
"ghsa-87pf-fpwv-p7m7",
"ghsa-hm49-wcqc-g2xg",
"ghsa-q2mw-fvj9-vvcw",
"ghsa-vcgp-9326-pqcp"
]
}
cleanstart-2026-ut74115
Vulnerability from cleanstart
Published
2026-07-21 08:19
Modified
2026-07-08 04:44
Summary
Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4
Details
Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details.
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "ruby-fluentd-1.19"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.2-r4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-UT74115",
"modified": "2026-07-08T04:44:58Z",
"published": "2026-07-21T08:19:01.995115Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UT74115.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33637"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41316"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42245"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42246"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42256"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42257"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42258"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54171"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54297"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54696"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54904"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54905"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54906"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5rv5-xj5j-3484"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-6wx8-w4f5-wwcr"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-75xq-5h9v-w6px"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-87pf-fpwv-p7m7"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-98m9-hrrm-r99r"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-h8w8-99g7-qmvj"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-hm49-wcqc-g2xg"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-q2mw-fvj9-vvcw"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vcgp-9326-pqcp"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wv3x-4vxv-whpp"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33637"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41316"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42245"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42246"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42256"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42257"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42258"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54171"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54297"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54696"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54904"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54905"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54906"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4",
"upstream": [
"CVE-2026-33637",
"CVE-2026-41316",
"CVE-2026-42245",
"CVE-2026-42246",
"CVE-2026-42256",
"CVE-2026-42257",
"CVE-2026-42258",
"CVE-2026-54171",
"CVE-2026-54297",
"CVE-2026-54696",
"CVE-2026-54904",
"CVE-2026-54905",
"CVE-2026-54906",
"ghsa-5rv5-xj5j-3484",
"ghsa-6wx8-w4f5-wwcr",
"ghsa-75xq-5h9v-w6px",
"ghsa-87pf-fpwv-p7m7",
"ghsa-98m9-hrrm-r99r",
"ghsa-h8w8-99g7-qmvj",
"ghsa-hm49-wcqc-g2xg",
"ghsa-q2mw-fvj9-vvcw",
"ghsa-vcgp-9326-pqcp",
"ghsa-wv3x-4vxv-whpp"
]
}
FKIE_CVE-2026-42257
Vulnerability from fkie_nvd - Published: 2026-05-09 20:16 - Updated: 2026-07-24 21:10
Severity
Summary
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/ruby/net-imap/releases/tag/v0.4.24 | Release Notes | |
| security-advisories@github.com | https://github.com/ruby/net-imap/releases/tag/v0.5.14 | Release Notes | |
| security-advisories@github.com | https://github.com/ruby/net-imap/releases/tag/v0.6.4 | Release Notes | |
| security-advisories@github.com | https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg | Mitigation, Vendor Advisory |
{
"affected": [
{
"affectedData": [
{
"product": "net-imap",
"vendor": "ruby",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.24"
},
{
"status": "affected",
"version": "\u003e= 0.5.0, \u003c 0.5.14"
},
{
"status": "affected",
"version": "\u003e= 0.6.0, \u003c 0.6.4"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
"matchCriteriaId": "05DB8FF3-7546-470A-BBB4-4DCAEAD83D6F",
"versionEndExcluding": "0.4.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
"matchCriteriaId": "2CCEB891-1D8F-4431-A79C-2A7560A84F4E",
"versionEndExcluding": "0.5.14",
"versionStartIncluding": "0.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*",
"matchCriteriaId": "9A6D1995-BFA3-490F-967D-252CA7BE2264",
"versionEndExcluding": "0.6.4",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4."
},
{
"lang": "es",
"value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. Antes de las versiones 0.4.24, 0.5.14 y 0.6.4, varios comandos de Net::IMAP aceptan un argumento de cadena sin procesar que se env\u00eda al servidor sin validaci\u00f3n ni escape. Si esta cadena se deriva de una entrada controlada por el usuario, puede contener secuencias CRLF, que un atacante puede usar para inyectar comandos IMAP arbitrarios. Este problema ha sido parcheado en las versiones 0.4.24, 0.5.14 y 0.6.4."
}
],
"id": "CVE-2026-42257",
"lastModified": "2026-07-24T21:10:00.143",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-42257",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T19:27:16.888782Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-09T20:16:28.463",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4"
},
{
"source": "security-advisories@github.com",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-93"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-HM49-WCQC-G2XG
Vulnerability from github – Published: 2026-05-04 22:04 – Updated: 2026-06-17 19:45
VLAI
Summary
net-imap vulnerable to command Injection via "raw" arguments to multiple commands
Details
Summary
Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.
Details
Net::IMAP's generic argument handling, used by most command arguments, interprets string arguments as an IMAP astring. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a atom, quoted, or literal. These are safe from command or argument injection.
But the following commands transform specific String arguments to Net::IMAP::RawData, which bypasses normal argument validation and encoding and prints the string directly to the socket:
* #uid_search, #search, #uid_sort, #sort, #uid_thread, #thread
* when criteria is a String, it is sent raw
* #uid_fetch, #fetch
* whenattris a String, it is sent raw
* whenattris an Array, each String inattris sent raw
*#uid_store,#store* whenattris a String, it is sent raw
*#setquota:
*limitis interpolated with#to_s` and that string is sent raw
Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.
Using \"raw data\" arguments for #uid_store, #store, and #setquota I both inappropriate and unnecessary. Net::IMAP's generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.
The API for search criteria and fetch attributes is intentionally low-level and \"close to the wire\". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.
Although this was explicitly documented for search criteria, it was insufficiently documented for fetch attr. So developers may not have realized that the attr argument to #fetch and #uid_fetch is sent as \"raw data\".
Impact
If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.
The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.
The SORT and THREAD commands and their UID variants also handle their search criteria argument similarly to SEARCH and are subject to the same risk.
Expected use of Net::IMAP#setquota is much more limited: SETQUOTA is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol SETQUOTA command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling #setquota with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target users or scripts with administrator privileges.
Mitigation
- Update to a patched version of
net-imapwhich: - validates that
Net::IMAP::RawDatais composed of well-formed IMAPtext,literal, andliteral8values, with no unescapedNULL,CR, orLFbytes. - does not use
Net::IMAP::RawDatafor#store,#uid_store, or#setquota. - Prefer to send search criteria as an array of key value pairs. Avoid sending it as an interpolated string.
- If an immediate upgrade is not possible:
- String inputs to search criteria and fetch attributes can be validated against command injection by checking for
\rand\ncharacters. - Hard-coding the store
attrargument is often appropriate. Alternatively, user controlled inputs can be restricted to a small enumerated list which is valid for the calling application. - Use
Kernel#Integerto coerce and validate user controlled inputs to#setquotalimit.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.6.3"
},
"package": {
"ecosystem": "RubyGems",
"name": "net-imap"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.0"
},
{
"fixed": "0.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.13"
},
"package": {
"ecosystem": "RubyGems",
"name": "net-imap"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "0.5.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.4.23"
},
"package": {
"ecosystem": "RubyGems",
"name": "net-imap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42257"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-04T22:04:41Z",
"nvd_published_at": "2026-05-09T20:16:28Z",
"severity": "MODERATE"
},
"details": "### Summary\nSeveral `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.\n\n### Details\n\n`Net::IMAP`\u0027s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection\u0027s UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.\n\nBut the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket:\n* `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread`\n * when `criteria` is a String, it is sent raw\n* `#uid_fetch`, `#fetch\n * when `attr` is a String, it is sent raw\n * when `attr` is an Array, each String in `attr` is sent raw\n* `#uid_store`, `#store`\n * when `attr` is a String, it is sent raw\n* `#setquota`:\n * `limit` is interpolated with `#to_s` and that string is sent raw\n\nBecause these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.\n\nUsing \\\"raw data\\\" arguments for `#uid_store`, `#store`, and `#setquota` I both inappropriate and unnecessary. `Net::IMAP`\u0027s generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.\n\nThe API for search criteria and fetch attributes is intentionally low-level and \\\"close to the wire\\\". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.\n\nAlthough this was explicitly documented for search `criteria`, it was insufficiently documented for fetch `attr`. So developers may not have realized that the `attr` argument to `#fetch` and `#uid_fetch` is sent as \\\"raw data\\\".\n\n### Impact\n\nIf a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not _directly_ enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system\u0027s attributes, e.g.: shared mail folders or the application\u0027s installed response handlers.\n\nThe SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.\n\nThe SORT and THREAD commands and their UID variants also handle their search criteria argument similarly to SEARCH and are subject to the same risk.\n\nExpected use of `Net::IMAP#setquota` is much more limited: `SETQUOTA` is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol `SETQUOTA` command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling `#setquota` with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target users or scripts with administrator privileges.\n\n### Mitigation\n - Update to a patched version of `net-imap` which:\n - validates that `Net::IMAP::RawData` is composed of well-formed IMAP `text`, `literal`, and `literal8` values, with no unescaped `NULL`, `CR`, or `LF` bytes.\n - does not use `Net::IMAP::RawData` for `#store`, `#uid_store`, or `#setquota`.\n - Prefer to send search criteria as an array of key value pairs. Avoid sending it as an interpolated string.\n - If an immediate upgrade is not possible:\n - String inputs to search criteria and fetch attributes can be validated against command injection by checking for `\\r` and `\\n` characters.\n - Hard-coding the store `attr` argument is often appropriate. Alternatively, user controlled inputs can be restricted to a small enumerated list which is valid for the calling application.\n - Use `Kernel#Integer` to coerce and validate user controlled inputs to `#setquota` limit.",
"id": "GHSA-hm49-wcqc-g2xg",
"modified": "2026-06-17T19:45:30Z",
"published": "2026-05-04T22:04:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42257"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/commit/0ec4fd351263e8b9a4f683713427827b7b1ad974"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/commit/47c72186d272441878ca73c9499f66013829ca2f"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/commit/a4f7649c3da77dec7631f03a037a478eb4330048"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/commit/aec06996eb87a7e1bbcef1f9f8926e8add2b8c71"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/net-imap"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/releases/tag/v0.5.14"
},
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-42257.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "net-imap vulnerable to command Injection via \"raw\" arguments to multiple commands"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…