Back Linuxsecurity

Oracle Linux 9 Ruby Important Memory Exhaustion Fix ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 1, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

ruby [4.0.6-35] - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252035 [4.0.6-34] - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 [4.0.3-33] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. (CVE-2026-42245) Resolves: RHEL-181690 - Fix Net::IMAP STARTTLS stripping vulnerability. (CVE-2026-42246) Resolves: RHEL-181771 - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments. (CVE-2026-42258) Resolves: RHEL-181803 [4.0.3-32] - Upgrade to Ruby 4.0.3. Resolves: RHEL-171933 - Fix ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) Resolves: RHEL-171258 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) Resolves: RHEL-173458 [4.0.1-31] - Upgrade to Ruby 4.0.1. Resolves: RHEL-142278 [3.3.10-5] - Upgrade to Ruby 3.3.10. Resolves...

ruby-4.0.6-35.module+el9.8.0+91047+ad9c8476.i686.rpm ruby-4.0.6-35.module+el9.8.0+91047+ad9c8476.x86_64.rpm ruby-bundled-gems-4.0.6-35.module+el9.8.0+91047+ad9c8476.i686.rpm ruby-bundled-gems-4.0.6-35.module+el9.8.0+91047+ad9c8476.x86_64.rpm ruby-default-gems-4.0.6-35.module+el9.8.0+91047+ad9c8476.noarch.rpm ruby-devel-4.0.6-35.module+el9.8.0+91047+ad9c8476.i686.rpm ruby-devel-4.0.6-35.module+el9.8.0+91047+ad9c8476.x86_64.rpm ruby-doc-4.0.6-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-bigdecimal-4.0.1-35.module+el9.8.0+91047+ad9c8476.i686.rpm rubygem-bigdecimal-4.0.1-35.module+el9.8.0+91047+ad9c8476.x86_64.rpm rubygem-bundler-4.0.16-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-io-console-0.8.2-35.module+el9.8.0+91047+ad9c8476.i686.rpm rubygem-io-console-0.8.2-35.module+el9.8.0+91047+ad9c8476.x86_64.rpm rubygem-irb-1.16.0-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-json-2.18.0-35.module+el9.8.0+91047+ad9c8476.i686.rpm rubygem-json-2.18.0-35.module+el9.8.0+91047+...

ruby-4.0.6-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm ruby-bundled-gems-4.0.6-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm ruby-default-gems-4.0.6-35.module+el9.8.0+91047+ad9c8476.noarch.rpm ruby-devel-4.0.6-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm ruby-doc-4.0.6-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-bigdecimal-4.0.1-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-bundler-4.0.16-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-io-console-0.8.2-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-irb-1.16.0-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-json-2.18.0-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-minitest-6.0.0-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-mysql2-0.5.7-1.module+el9.8.0+90938+383082f5.aarch64.rpm rubygem-mysql2-doc-0.5.7-1.module+el9.8.0+90938+383082f5.noarch.rpm rubygem-pg-1.6.3-1.module+el9.8.0+90938+383082f5.aarch64.rpm rubygem-pg-doc-1.6.3-1.module+el9.8.0+90938+383082f5.noarch.rpm rubygem-power_assert-3.0.1-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-psych-5.3.1-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-racc-1.8.1-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-rake-13.3.1-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-rbs-3.10.0-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm rubygem-rdoc-7.0.4-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-rexml-3.4.4-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-rss-0.3.2-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygems-4.0.16-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygems-devel-4.0.16-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-test-unit-3.7.5-35.module+el9.8.0+91047+ad9c8476.noarch.rpm rubygem-typeprof-0.31.1-35.module+el9.8.0+91047+ad9c8476.noarch.rpm ruby-libs-4.0.6-35.module+el9.8.0+91047+ad9c8476.aarch64.rpm

Related CVEs: CVE-2026-80212

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Ruby Memory Exhaustion Vulnerabilities in Oracle Linux Fixed On October 1, 2026, Oracle released security updates for Ruby in Oracle Linux 9 and 10, addressing multiple memory exhaustion vulnerabilities. The most significant flaw, CVE-2026-80212, affects Ruby versions 3.0.7 and 4.0.6, allowing for potential denial of service through unknown DNS resource types. Other vulnerabilities include CVE-2026-42246, which enables information disclosure via MITM attacks, and CVE-2026-42258, allowing command injection through unvalidated Symbol arguments. These vulnerabilities could lead to server code execution, particularly affecting self-managed GitLab instances. Users are urged to upgrade to the patched Ruby versions immediately. The vulnerabilities were disclosed between May and August 2026, with the most fix released on the same day as the advisory. 4 sources 61

Extracted Entities

CVEs (6)

CVE-2026-33210 CVE-2026-41316 CVE-2026-42245 CVE-2026-42246 CVE-2026-42258 CVE-2026-80212

CWE Weaknesses (3)

CWE-200 - Exposure of Sensitive Information CWE-502 - Deserialization Of Untrusted Data CWE-78 - OS Command Injection