An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-raccUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade ruby-docUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-net-telnetUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-pg-doc | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubyUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimal | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-develUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfo | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby3.1Upgrade ruby2.7 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade ruby32Upgrade ruby33Upgrade rubyUpgrade ruby31 | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade ruby-docUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-rbsUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-typeprofUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-did_you_mean | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-xmlrpcUpgrade rubygem-bson-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-mongoUpgrade rubygem-typeprofUpgrade rubygem-json-debuginfoUpgrade rubygemsUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-raccUpgrade rubygem-pg-debuginfoUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-rssNo solution existsUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-docUpgrade ruby-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-rbsUpgrade rubygem-opensslUpgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade rubygem-bson-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-json | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-opensslUpgrade rubygem-bson-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-racc-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-racc | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.0Upgrade libruby3.1Upgrade libruby3.2Upgrade ruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.1 | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub