An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-bson-docUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-typeprof | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubyUpgrade ruby-irbUpgrade rubygem-json | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-develUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libs-debuginfo | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.1 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade rubyUpgrade ruby31Upgrade ruby33Upgrade ruby32 | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-rssUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-typeprofUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygems-develUpgrade rubygem-raccUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-default-gemsUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-mongoUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-rexml | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongoUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rbs-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bsonNo solution existsUpgrade rubygem-bundlerUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-opensslUpgrade rubygem-rssUpgrade rubygem-bson-debuginfoUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-rbsUpgrade rubygem-mongo-doc | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade rubygem-bson-debuginfoUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs-debuginfo | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade libruby3.1Upgrade libruby3.0Upgrade libruby3.2Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.1 | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub