openRuyi Lookout
← Packages

ruby

autotoolsAdvisory 2

Ruby programming language interpreter

Current
4.0.4
Candidate
4.0.9
License
(Ruby OR BSD-2-Clause) AND MIT

Build

TargetResultLast successful versionSucceeded at
rva23
4.0.4
rva20
4.0.4
x86_64
4.0.4

Advisory · 2

Query product
rubyNVD
Query vendor
ruby-langNVD
Query version
4.0.4NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

  • CVE-2026-46727
    NVD
    Summary
    An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.NVD
    EPSS model date
    2026-11-10FIRST
    EPSS probability
    0.478%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*; >= 4.0.0, < 4.0.5NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
  • CVE-2026-97229KEV
    NVD
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.NVD
    EPSS model date
    2026-11-10FIRST
    EPSS probability
    65.2%FIRST
    KEV added
    2026-10-29CISA
    Ransomware campaign use
    UnknownCISA
    Vulnerable CPE criteria
    cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*; >= 3.3.0, < 3.3.13, cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*; >= 3.4.0, < 3.4.12, cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*; >= 4.0.0, < 4.0.8NVD
    Aliases
    —NVD
    KEV
    YesCISA
    CVSS_V3
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HNVD

Description

Ruby is an interpreted, object-oriented programming language focused on developer productivity. This package provides the Ruby interpreter, the core standard library, and the runtime shared library.

Changelog

PR · 4

Checks
MonitorObservationLast checked
Source
Checked
Version
Checked
Build
Checked
GitHub
Checked
EOL
Checked
Current source cycle 4.0; upstream lifecycle only.
LicenseDiff
Not configured
No reliable monitor identity/configuration.
—
Dependencies
Not configured
No reliable monitor identity/configuration.
—
Advisory
Checked
Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.
Last attempted
Yanked
Not configured
No reliable monitor identity/configuration.
—