An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-mongoUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade ruby-bundled-gemsUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-raccUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-rake | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-irbUpgrade ruby-tcltkUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-devel | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rss | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby3.1Upgrade ruby2.7 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade rubyUpgrade ruby31Upgrade ruby32Upgrade ruby33 | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-rbsUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-rssUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade ruby-docUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-bundlerUpgrade rubygems-devel | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rssUpgrade rubygem-bson-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundler-docNo solution existsUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade ruby-docUpgrade ruby-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfo | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.1Upgrade ruby3.2Upgrade libruby3.2Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.1 | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub