An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3.1.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-mongo-docUpgrade rubygem-jsonUpgrade rubygem-rexmlUpgrade rubygem-bsonUpgrade ruby-bundled-gemsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubyUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-rss | Jun 3, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade ruby | Jun 6, 2024 | May 8, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ruby-develUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby-libs | Sep 19, 2024 | May 14, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2Upgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-default-gemsUpgrade ruby3.2-libsUpgrade ruby3.2-develUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-bundled-gems | Feb 17, 2025 | Apr 23, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.1 | May 6, 2024 | May 6, 2024 |
| Freebsd | — | Upgrade ruby33Upgrade ruby32Upgrade rubyUpgrade ruby31 | Dec 10, 2025 | Apr 23, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Oct 9, 2024 | May 14, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 8, 2024 | May 14, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-raccUpgrade rubygem-bsonUpgrade rubygem-typeprofUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rbsUpgrade rubygem-bson-docUpgrade rubygem-io-consoleUpgrade rubygem-rss | Jun 1, 2024 | Apr 23, 2024 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-bundler-docUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-racc-debuginfoUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-psych-debuginfoUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceNo solution existsUpgrade rubygem-bson-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade ruby-libs-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygem-mysql2-debugsourceUpgrade rubygemsUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdoc | May 31, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade ruby-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-racc-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade rubygem-bson-debugsource | Jun 17, 2024 | May 14, 2024 |
| Ubuntu | — | Upgrade libruby3.2Upgrade ruby3.2Upgrade ruby2.7Upgrade libruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby3.1Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.1Upgrade libruby2.7 | Jun 21, 2024 | May 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 8, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub