An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-xmlrpcUpgrade rubygem-rbsUpgrade rubyUpgrade rubygem-rexmlUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade rubygem-raccUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygems-develUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-rdoc | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-psychUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-develUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygems | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-minitest | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.1 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade ruby32Upgrade ruby33Upgrade rubyUpgrade ruby31 | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-pg-docUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-raccUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-pgUpgrade ruby-default-gems | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-mongoUpgrade ruby-irbUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-rssUpgrade rubygem-opensslUpgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-jsonNo solution existsUpgrade rubygem-racc-debuginfoUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debugsource | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-json | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.1Upgrade libruby2.7Upgrade ruby2.7Upgrade libruby3.1Upgrade libruby3.2Upgrade ruby3.2Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro) | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub