An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-rdocUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-openssl | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rdocUpgrade rubygem-jsonUpgrade ruby-irbUpgrade ruby-develUpgrade rubyUpgrade rubygemsUpgrade ruby-docUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-debuginfo | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2Upgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-develUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-console-debuginfo | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.1 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade ruby32Upgrade ruby33Upgrade ruby31Upgrade ruby | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-typeprofUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-irbUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-raccUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade ruby-doc | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade ruby-irbUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-raccUpgrade rubygem-bson-docUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-test-unitUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-did_you_meanUpgrade ruby-debugsourceUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-mongo-docUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-jsonNo solution existsUpgrade rubygem-bundler-docUpgrade rubygem-rssUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-irb | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimal | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade ruby3.1Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.7Upgrade libruby3.2Upgrade libruby3.1Upgrade ruby3.2Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro) | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub