Ruby-Lang / Ruby
93 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo i… | HIGH | 8.1 | May 22, 2026 |
| CVE-2024-27280 | ruby: Buffer overread vulnerability in StringIO | CRITICAL | 9.3 | May 8, 2024 |
| CVE-2023-28756 | ruby: ReDoS vulnerability in Time | HIGH | 7.5 | Mar 31, 2023 |
| CVE-2021-33621 | ruby/cgi-gem: HTTP response splitting in CGI | HIGH | 8.8 | Nov 18, 2022 |
| CVE-2022-28739 | ruby: Buffer overrun in String-to-Float conversion | HIGH | 7.5 | May 9, 2022 |
| CVE-2022-28738 | Ruby: Double free in Regexp compilation | CRITICAL | 9.8 | May 9, 2022 |
| CVE-2021-41819 | ruby: Cookie prefix spoofing in CGI::Cookie.parse | HIGH | 7.5 | Jan 1, 2022 |
| CVE-2021-41817 | ruby: Regular expression denial of service vulnerability of Date parsing methods | HIGH | 7.5 | Jan 1, 2022 |
| CVE-2021-32066 | ruby: StartTLS stripping vulnerability in Net::IMAP | HIGH | 7.4 | Aug 1, 2021 |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. | HIGH | 7.5 | Jul 27, 2021 |
| CVE-2021-31810 | ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host | MEDIUM | 5.8 | Jul 13, 2021 |
| CVE-2021-28965 | ruby: XML round-trip vulnerability in REXML | HIGH | 7.5 | Apr 21, 2021 |
| CVE-2020-25613 | ruby: Potential HTTP request smuggling in WEBrick | HIGH | 7.5 | Oct 6, 2020 |
| CVE-2020-10933 | ruby: BasicSocket#read_nonblock method leads to information disclosure | MEDIUM | 5.3 | May 4, 2020 |
| CVE-2020-5247 | HTTP Response Splitting in Puma | HIGH | 7.5 | Feb 28, 2020 |
| CVE-2016-2338 | ruby: heap buffer overflow in the Psych::Emitter start_document function | CRITICAL | 9.8 | Feb 14, 2020 |
| CVE-2015-1855 | ruby: OpenSSL extension hostname matching implementation violates RFC 6125 | MEDIUM | 5.9 | Nov 29, 2019 |
| CVE-2019-15845 | ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? | MEDIUM | 6.5 | Nov 26, 2019 |
| CVE-2011-4121 | extension): Insecure way of creation exponent value by private RSA key generation | CRITICAL | 9.8 | Nov 26, 2019 |
| CVE-2011-3624 | WEBrick:: HTTPRequest X-Forwarded-* allows arbitrary data | MEDIUM | 5.3 | Nov 26, 2019 |
| CVE-2019-16255 | ruby: Code injection via command argument of Shell#test / Shell#[] | HIGH | 8.1 | Nov 26, 2019 |
| CVE-2019-16254 | ruby: HTTP response splitting in WEBrick | MEDIUM | 5.3 | Nov 26, 2019 |
| CVE-2019-16201 | ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication | HIGH | 7.5 | Nov 26, 2019 |
| CVE-2018-16396 | ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives | HIGH | 8.1 | Nov 16, 2018 |
| CVE-2018-16395 | ruby: OpenSSL::X509:: Name equality check does not work correctly | CRITICAL | 9.8 | Nov 16, 2018 |
Showing 1 to 25 of 93 CVEs