Back Linuxsecurity

Oracle Linux 10 Ruby 4.0 Major Memory Exhaustion Fix ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 1, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[4.0.6-37] - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252032

ruby4.0-4.0.6-37.el10_2.x86_64.rpm ruby4.0-devel-4.0.6-37.el10_2.x86_64.rpm ruby4.0-doc-4.0.6-37.el10_2.noarch.rpm ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.x86_64.rpm ruby4.0-rubygem-pg-1.6.3-37.el10_2.x86_64.rpm

ruby4.0-4.0.6-37.el10_2.aarch64.rpm ruby4.0-devel-4.0.6-37.el10_2.aarch64.rpm ruby4.0-doc-4.0.6-37.el10_2.noarch.rpm ruby4.0-rubygem-mysql2-0.5.7-37.el10_2.aarch64.rpm ruby4.0-rubygem-pg-1.6.3-37.el10_2.aarch64.rpm

Related CVEs: CVE-2026-80212

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Ruby Memory Exhaustion Vulnerabilities in Oracle Linux Fixed On October 1, 2026, Oracle released security updates for Ruby in Oracle Linux 9 and 10, addressing multiple memory exhaustion vulnerabilities. The most significant flaw, CVE-2026-80212, affects Ruby versions 3.0.7 and 4.0.6, allowing for potential denial of service through unknown DNS resource types. Other vulnerabilities include CVE-2026-42246, which enables information disclosure via MITM attacks, and CVE-2026-42258, allowing command injection through unvalidated Symbol arguments. These vulnerabilities could lead to server code execution, particularly affecting self-managed GitLab instances. Users are urged to upgrade to the patched Ruby versions immediately. The vulnerabilities were disclosed between May and August 2026, with the most fix released on the same day as the advisory. 4 sources 61

Extracted Entities

CVEs (1)

CVE-2026-80212

Platforms (1)

Oracle Linux 10