Ruby-lang Ruby
112 CVEs affecting Ruby-lang Ruby. Latest disclosed: 2026-05-22. Critical: 14, High: 29.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2338 | Critical | 9.8 | 2022-09-29 | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer… |
CVE-2022-28738 | Critical | 9.8 | 2022-05-09 | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user inp… |
CVE-2021-41816 | Critical | 9.8 | 2022-02-06 | CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows… |
CVE-2011-4121 | Critical | 9.8 | 2019-11-26 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key g… |
CVE-2018-16395 | Critical | 9.8 | 2018-11-16 | An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL… |
CVE-2017-17790 | Critical | 9.8 | 2017-12-20 | The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv… |
CVE-2017-14064 | Critical | 9.8 | 2017-08-31 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ex… |
CVE-2017-11465 | Critical | 9.8 | 2017-07-19 | The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecifie… |
CVE-2017-9225 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in on… |
CVE-2016-2339 | Critical | 9.8 | 2017-01-06 | An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize"… |
CVE-2016-2337 | Critical | 9.8 | 2017-01-06 | Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitra… |
CVE-2016-2336 | Critical | 9.8 | 2017-01-06 | Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed… |
CVE-2018-8780 | Critical | 9.1 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? method… |
CVE-2017-0898 | Critical | 9.1 | 2017-09-15 | Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation… |
CVE-2021-33621 | High | 8.8 | 2022-11-18 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untru… |
CVE-2017-17405 | High | 8.8 | 2017-12-15 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a lo… |
CVE-2017-10784 | High | 8.8 | 2017-09-19 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal e… |
CVE-2015-7551 | High | 8.4 | 2016-03-24 | The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before… |
CVE-2026-46727 | High | 8.1 | 2026-05-22 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo i… |
CVE-2019-16255 | High | 8.1 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#… |