Back Linuxsecurity

Oracle Linux 9 Ruby Important DoS Info Disclosure Cmd Inj ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 6, 2026

ruby [3.3.10-7] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181693 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181779 - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258) Resolves: RHEL-181811 rubygem-mysql2 [0.5.5-3] - Disable tests on the 32bit platforms ix86. Related: RHEL-80222 rubygem-pg [-1.5.4-2] - Fix encoding issue in spec suite. Resolves: RHEL-159199

ruby-3.3.10-7.module+el9.8.0+90944+8975e57f.i686.rpm ruby-3.3.10-7.module+el9.8.0+90944+8975e57f.x86_64.rpm ruby-bundled-gems-3.3.10-7.module+el9.8.0+90944+8975e57f.i686.rpm ruby-bundled-gems-3.3.10-7.module+el9.8.0+90944+8975e57f.x86_64.rpm ruby-default-gems-3.3.10-7.module+el9.8.0+90944+8975e57f.noarch.rpm ruby-devel-3.3.10-7.module+el9.8.0+90944+8975e57f.i686.rpm ruby-devel-3.3.10-7.module+el9.8.0+90944+8975e57f.x86_64.rpm ruby-doc-3.3.10-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-bigdecimal-3.1.5-7.module+el9.8.0+90944+8975e57f.i686.rpm rubygem-bigdecimal-3.1.5-7.module+el9.8.0+90944+8975e57f.x86_64.rpm rubygem-bundler-2.5.22-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-io-console-0.7.1-7.module+el9.8.0+90944+8975e57f.i686.rpm rubygem-io-console-0.7.1-7.module+el9.8.0+90944+8975e57f.x86_64.rpm rubygem-irb-1.13.1-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-json-2.7.2-7.module+el9.8.0+90944+8975e57f.i686.rpm rubygem-json-2.7.2-7.module+el9.8.0+90944+8975e57f.x...

ruby-3.3.10-7.module+el9.8.0+90944+8975e57f.aarch64.rpm ruby-bundled-gems-3.3.10-7.module+el9.8.0+90944+8975e57f.aarch64.rpm ruby-default-gems-3.3.10-7.module+el9.8.0+90944+8975e57f.noarch.rpm ruby-devel-3.3.10-7.module+el9.8.0+90944+8975e57f.aarch64.rpm ruby-doc-3.3.10-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-bigdecimal-3.1.5-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-bundler-2.5.22-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-io-console-0.7.1-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-irb-1.13.1-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-json-2.7.2-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-minitest-5.20.0-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-mysql2-0.5.5-3.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-mysql2-doc-0.5.5-3.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-pg-1.5.4-2.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-pg-doc-1.5.4-2.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-power_assert-2.0.3-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-psych-5.1.2-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-racc-1.7.3-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-rake-13.1.0-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-rbs-3.4.0-7.module+el9.8.0+90944+8975e57f.aarch64.rpm rubygem-rdoc-6.6.3.1-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-rexml-3.4.4-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-rss-0.3.1-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygems-3.5.22-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygems-devel-3.5.22-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-test-unit-3.6.1-7.module+el9.8.0+90944+8975e57f.noarch.rpm rubygem-typeprof-0.21.9-7.module+el9.8.0+90944+8975e57f.noarch.rpm ruby-libs-3.3.10-7.module+el9.8.0+90944+8975e57f.aarch64.rpm

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Ruby Vulnerabilities in Oracle Linux Require Immediate Attention Recent updates for Oracle Linux address critical vulnerabilities in Ruby affecting versions 2.5, 3.3, and 4.0. Key issues include a code execution flaw (CVE-2026-41316) and denial of service vulnerabilities (CVE-2026-42245, CVE-2026-33210) that could be exploited via crafted IMAP responses and format string injections. The vulnerabilities impact various Ruby gems and could allow attackers to execute arbitrary code or disclose sensitive information. Systems running Oracle Linux 8 and 9 are at risk, necessitating immediate patching. The vulnerabilities were disclosed between March and May 2026, with some having public proof-of-concept exploits. Administrators are advised to update their Ruby installations and associated gems promptly to mitigate these risks. 8 sources 72

Extracted Entities

Oracle Linux 9 Ruby Important DoS Info Disclosure Cmd Inj ELSA-2026

The full story

Extracted Entities

Attack Types (3)

CVEs (3)

CWE Weaknesses (2)

IP Addresses (1)

MITRE ATT&CK (1)

Platforms (1)