{"schema_version":1,"title":"Ruby vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Ruby: 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-82455, was published on 29 August 2026.","url":"https://junglewise.ai/threats/vendors/ruby","json_url":"https://junglewise.ai/threats/vendors/ruby.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/ruby","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":4,"all_time":13,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":4,"last_365_days":13},"latest":[{"cve":"CVE-2026-82455","slug":"cve-2026-82455-rubygems-symlink-following-behavior-in-gem-extraction","title":"RubyGems symlink-following behavior in gem extraction","severity":"info","exploited":false,"published_at":"2026-08-29T14:16:38.623+00:00","url":"https://junglewise.ai/threats/cve-2026-82455-rubygems-symlink-following-behavior-in-gem-extraction"},{"cve":"CVE-2026-80213","cvss":4,"epss":0.0035,"slug":"cve-2026-80213-ruby-resolv-dns-label-encoding-bypass","title":"Ruby resolv DNS label encoding bypass","severity":"medium","exploited":false,"published_at":"2026-08-27T17:20:51.037+00:00","url":"https://junglewise.ai/threats/cve-2026-80213-ruby-resolv-dns-label-encoding-bypass"},{"cve":"CVE-2026-80212","cvss":7.5,"epss":0.0057,"slug":"cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing","title":"Ruby resolv memory exhaustion in DNS response parsing","severity":"high","exploited":false,"published_at":"2026-08-27T17:20:50.88+00:00","url":"https://junglewise.ai/threats/cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing"},{"cve":"CVE-2026-38969","cvss":0,"slug":"cve-2026-38969-ruby-webrick-request-smuggling-via-content-length-in-trailers","title":"Ruby WEBrick request smuggling via Content-Length in trailers","severity":"info","exploited":false,"published_at":"2026-07-02T21:16:56.05+00:00","url":"https://junglewise.ai/threats/cve-2026-38969-ruby-webrick-request-smuggling-via-content-length-in-trailers"},{"cve":"CVE-2026-47242","cvss":5.8,"slug":"cve-2026-47242-ruby-net-imap-command-injection-in-id-and-enable-commands","title":"Ruby Net::IMAP command injection in ID and ENABLE commands","severity":"medium","exploited":false,"published_at":"2026-06-22T21:16:24.807+00:00","url":"https://junglewise.ai/threats/cve-2026-47242-ruby-net-imap-command-injection-in-id-and-enable-commands"},{"cve":"CVE-2026-47241","cvss":2.1,"slug":"cve-2026-47241-ruby-net-imap-denial-of-service-via-incomplete-raw-argument","title":"Ruby Net::IMAP denial of service via incomplete raw argument validation","severity":"low","exploited":false,"published_at":"2026-06-22T21:16:24.677+00:00","url":"https://junglewise.ai/threats/cve-2026-47241-ruby-net-imap-denial-of-service-via-incomplete-raw-argument"},{"cve":"CVE-2026-47240","cvss":5.8,"slug":"cve-2026-47240-ruby-net-imap-command-injection-via-non-synchronizing-literals","title":"Ruby Net::IMAP command injection via non-synchronizing literals","severity":"medium","exploited":false,"published_at":"2026-06-22T21:16:24.543+00:00","url":"https://junglewise.ai/threats/cve-2026-47240-ruby-net-imap-command-injection-via-non-synchronizing-literals"},{"cve":"CVE-2026-42257","cvss":9.8,"epss":0.0041,"slug":"cve-2026-42257-ruby-net-imap-command-injection-in-multiple-commands","title":"Ruby Net::IMAP command injection in multiple commands","severity":"critical","exploited":false,"published_at":"2026-05-09T20:16:28.463+00:00","url":"https://junglewise.ai/threats/cve-2026-42257-ruby-net-imap-command-injection-in-multiple-commands"},{"cve":"CVE-2026-42256","cvss":6.5,"epss":0.0007,"slug":"cve-2026-42256-ruby-net-imap-computational-dos-in-scram-authentication","title":"Ruby Net::IMAP computational DoS in SCRAM authentication","severity":"medium","exploited":false,"published_at":"2026-05-09T20:16:28.313+00:00","url":"https://junglewise.ai/threats/cve-2026-42256-ruby-net-imap-computational-dos-in-scram-authentication"},{"cve":"CVE-2026-42246","cvss":7.4,"epss":0.0007,"slug":"cve-2026-42246-ruby-net-imap-starttls-stripping-vulnerability","title":"Ruby Net::IMAP STARTTLS stripping vulnerability","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:28.163+00:00","url":"https://junglewise.ai/threats/cve-2026-42246-ruby-net-imap-starttls-stripping-vulnerability"},{"cve":"CVE-2026-42245","cvss":7.5,"epss":0.0008,"slug":"cve-2026-42245-ruby-net-imap-denial-of-service-in-responsereader","title":"Ruby Net::IMAP denial of service in ResponseReader","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:28.017+00:00","url":"https://junglewise.ai/threats/cve-2026-42245-ruby-net-imap-denial-of-service-in-responsereader"},{"cve":"CVE-2026-27820","cvss":9.8,"epss":0.0002,"slug":"cve-2026-27820-ruby-zlib-buffer-overflow-in-zlib-gzipreader","title":"Ruby zlib buffer overflow in Zlib::GzipReader","severity":"critical","exploited":false,"published_at":"2026-04-16T18:16:44.77+00:00","url":"https://junglewise.ai/threats/cve-2026-27820-ruby-zlib-buffer-overflow-in-zlib-gzipreader"},{"cve":"CVE-2025-10990","cvss":7.5,"epss":0.0042,"slug":"cve-2025-10990-ruby-rexml-redos-in-hex-numeric-character-references","title":"Ruby REXML ReDoS in hex numeric character references","severity":"high","exploited":false,"published_at":"2026-02-27T14:16:27.567+00:00","url":"https://junglewise.ai/threats/cve-2025-10990-ruby-rexml-redos-in-hex-numeric-character-references"}],"vendor":{"hub":true,"name":"Ruby","slug":"ruby","homepage":"https://www.ruby-lang.org/","description":"The maintainers and community behind the Ruby programming language.","url":"https://junglewise.ai/threats/vendors/ruby"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-42257","cvss":9.8,"epss":0.0041,"slug":"cve-2026-42257-ruby-net-imap-command-injection-in-multiple-commands","title":"Ruby Net::IMAP command injection in multiple commands","severity":"critical","exploited":false,"published_at":"2026-05-09T20:16:28.463+00:00","url":"https://junglewise.ai/threats/cve-2026-42257-ruby-net-imap-command-injection-in-multiple-commands"},{"cve":"CVE-2026-27820","cvss":9.8,"epss":0.0002,"slug":"cve-2026-27820-ruby-zlib-buffer-overflow-in-zlib-gzipreader","title":"Ruby zlib buffer overflow in Zlib::GzipReader","severity":"critical","exploited":false,"published_at":"2026-04-16T18:16:44.77+00:00","url":"https://junglewise.ai/threats/cve-2026-27820-ruby-zlib-buffer-overflow-in-zlib-gzipreader"},{"cve":"CVE-2026-80212","cvss":7.5,"epss":0.0057,"slug":"cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing","title":"Ruby resolv memory exhaustion in DNS response parsing","severity":"high","exploited":false,"published_at":"2026-08-27T17:20:50.88+00:00","url":"https://junglewise.ai/threats/cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing"},{"cve":"CVE-2025-10990","cvss":7.5,"epss":0.0042,"slug":"cve-2025-10990-ruby-rexml-redos-in-hex-numeric-character-references","title":"Ruby REXML ReDoS in hex numeric character references","severity":"high","exploited":false,"published_at":"2026-02-27T14:16:27.567+00:00","url":"https://junglewise.ai/threats/cve-2025-10990-ruby-rexml-redos-in-hex-numeric-character-references"},{"cve":"CVE-2026-42245","cvss":7.5,"epss":0.0008,"slug":"cve-2026-42245-ruby-net-imap-denial-of-service-in-responsereader","title":"Ruby Net::IMAP denial of service in ResponseReader","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:28.017+00:00","url":"https://junglewise.ai/threats/cve-2026-42245-ruby-net-imap-denial-of-service-in-responsereader"},{"cve":"CVE-2026-42246","cvss":7.4,"epss":0.0007,"slug":"cve-2026-42246-ruby-net-imap-starttls-stripping-vulnerability","title":"Ruby Net::IMAP STARTTLS stripping vulnerability","severity":"high","exploited":false,"published_at":"2026-05-09T20:16:28.163+00:00","url":"https://junglewise.ai/threats/cve-2026-42246-ruby-net-imap-starttls-stripping-vulnerability"},{"cve":"CVE-2026-42256","cvss":6.5,"epss":0.0007,"slug":"cve-2026-42256-ruby-net-imap-computational-dos-in-scram-authentication","title":"Ruby Net::IMAP computational DoS in SCRAM authentication","severity":"medium","exploited":false,"published_at":"2026-05-09T20:16:28.313+00:00","url":"https://junglewise.ai/threats/cve-2026-42256-ruby-net-imap-computational-dos-in-scram-authentication"},{"cve":"CVE-2026-47242","cvss":5.8,"slug":"cve-2026-47242-ruby-net-imap-command-injection-in-id-and-enable-commands","title":"Ruby Net::IMAP command injection in ID and ENABLE commands","severity":"medium","exploited":false,"published_at":"2026-06-22T21:16:24.807+00:00","url":"https://junglewise.ai/threats/cve-2026-47242-ruby-net-imap-command-injection-in-id-and-enable-commands"},{"cve":"CVE-2026-47240","cvss":5.8,"slug":"cve-2026-47240-ruby-net-imap-command-injection-via-non-synchronizing-literals","title":"Ruby Net::IMAP command injection via non-synchronizing literals","severity":"medium","exploited":false,"published_at":"2026-06-22T21:16:24.543+00:00","url":"https://junglewise.ai/threats/cve-2026-47240-ruby-net-imap-command-injection-via-non-synchronizing-literals"},{"cve":"CVE-2026-80213","cvss":4,"epss":0.0035,"slug":"cve-2026-80213-ruby-resolv-dns-label-encoding-bypass","title":"Ruby resolv DNS label encoding bypass","severity":"medium","exploited":false,"published_at":"2026-08-27T17:20:51.037+00:00","url":"https://junglewise.ai/threats/cve-2026-80213-ruby-resolv-dns-label-encoding-bypass"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[]}