Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 115

Export CSV
CVE-2008-3443

ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS)

The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.

CVSS 2.0 · 5.0 Medium EPSS 15.7% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Ruby
CVE-2008-2376

ruby: integer overflows in rb_ary_fill() / Array#fill

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Fedora 8 Ruby
CVE-2008-3655

ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Ruby
CVE-2024-27280

ruby: Buffer overread vulnerability in StringIO

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Ruby
CVE-2023-28756

ruby: ReDoS vulnerability in Time

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 3 more
CVE-2022-28739

ruby: Buffer overrun in String-to-Float conversion

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Apple Debian Redhat and 1 more
Products
Macos Debian Linux Enterprise Linux and 2 more
CVE-2021-33621

ruby/cgi-gem: HTTP response splitting in CGI

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Redhat Ruby-lang
Products
Fedora Enterprise Linux Rhel Eus and 3 more
CVE-2025-27220

CGI: ReDoS in CGI::Util#escapeElement

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Cgi Ruby
CVE-2024-49761

REXML ReDoS vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

CVSS 4.0 · 6.6 Medium EPSS 1.4% KEV · Not listed
Vendors
Netapp Redhat Ruby and 1 more
Products
Ontap Tools Enterprise Linux Rhel Aus and 6 more
CVE-2021-41819

ruby: Cookie prefix spoofing in CGI::Cookie.parse

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 3 more
Products
Debian Linux Fedora Factory and 9 more
CVE-2017-10784

ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

CVSS 3.0 · 8.8 High EPSS 16.4% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Rhel Software Collections Ruby
CVE-2017-11465

ruby: Invalid read/write in parser_yyerror function in UTF-8 parser

The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script, related to the parser_tokadd_utf8 function in parse.y. NOTE: this might have security relevance as a bypass of a $SAFE protection mechanism.

CVSS 3.0 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby
CVE-2017-0898

ruby: Buffer underrun vulnerability in Kernel.sprintf

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

CVSS 3.0 · 9.1 Critical EPSS 9.7% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Rhel Software Collections Ruby
CVE-2017-14033

ruby: Buffer underrun in OpenSSL ASN1 decode

The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

CVSS 3.0 · 7.5 High EPSS 7.7% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Rhel Software Collections Ruby
CVE-2016-2336

ruby: WIN32OLE ole_invoke and ole_query_interface type confusion vulnerabilities

Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby
CVE-2016-2337

ruby: TclTkIp ip_cancel_eval type confusion vulnerability

Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby
CVE-2016-2339

ruby: Fiddle:: Function.new heap buffer overflow

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.

CVSS 3.0 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby
CVE-2017-14064

ruby: Arbitrary heap exposure during a JSON.generate call

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

CVSS 3.0 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2014-6438

ruby: Unsafe parsing of long strings via decode_www_form_component method

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

CVSS 3.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby
CVE-2017-6181

ruby: Stack overflow in parse_char_class() in Onigmo

The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.

CVSS 3.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Ruby-lang
Products
Ruby