{"schema_version":"1","data":[{"id":19323,"advisory_id":"0bdd03df-addd-47ae-8dc4-719deabe5cc6","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","source_published_at":"2026-08-27T00:00:00+00:00","published_at":"2026-10-25T02:56:23.183655+00:00","extraction_method":"llm","technologies":["resolv-gem","ruby"],"cve_ids":["CVE-2026-80212","CVE-2026-80213"],"event_types":["patch"],"payload":{"kind":"patch","title":"Security advisories: CVE-2026-80212 and CVE-2026-80213","summary":"Two vulnerabilities affect the resolv gem: malicious DNS responses can cause unbounded memory use, and overlong hostnames can bypass hostname validation. Upgrade to resolv 0.7.2, or 0.3.2 for Ruby 3.3; Ruby 3.2 users should install resolv 0.7.2 because no 0.2.x release is planned.","evidence":"Two vulnerabilities have been discovered in the resolv gem bundled with Ruby.","products":[{"name":{"value":"resolv gem","evidence":"Affected versions resolv gem 0.4.0 through 0.7.1"},"prerequisites":[{"value":"Only code that resolves names through this gem is affected.","evidence":"Only code that resolves names through this gem is affected."},{"value":"This requires a hostname that exceeds the DNS length limits","evidence":"This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected."}],"fixed_versions":[{"value":"0.7.2","evidence":"Update the resolv gem to 0.7.2."},{"value":"0.3.2","evidence":"For the Ruby 3.3 series, update to 0.3.2."},{"value":"0.7.2","evidence":"Install resolv 0.7.2 there instead."}],"affected_versions":[{"value":"0.4.0 through 0.7.1","evidence":"Affected versions resolv gem 0.4.0 through 0.7.1"},{"value":"0.3.1 and earlier","evidence":"resolv gem 0.3.1 and earlier"},{"value":"0.2.x","evidence":"No release is planned for the 0.2.x line that the Ruby 3.2 series ships"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-80212","evidence":"They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213."},{"value":"CVE-2026-80213","evidence":"They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19322,"advisory_id":"6c4e5dcd-b225-41bb-b5fe-5a0bd99e8db4","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released/","source_published_at":"2026-07-16T05:08:11+00:00","published_at":"2026-10-25T02:53:23.538262+00:00","extraction_method":"llm","technologies":["erb","net-imap","ruby"],"cve_ids":["CVE-2026-41316","CVE-2026-42245","CVE-2026-42246","CVE-2026-42256","CVE-2026-42257","CVE-2026-42258","CVE-2026-47240","CVE-2026-47241","CVE-2026-47242"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.3.12 Released","summary":"Ruby 3.3.12 includes security fixes, including an ERB deserialization guard-bypass fix and security fixes in the updated net-imap gem.","evidence":"Ruby 3.3.12 has been released. This release includes security fixes.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.3.12 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.3.12","evidence":"Ruby 3.3.12 has been released."}],"affected_versions":[]},{"name":{"value":"erb","evidence":"This release updates the default gem erb to 4.0.3.1"},"prerequisites":[],"fixed_versions":[{"value":"4.0.3.1","evidence":"This release updates the default gem erb to 4.0.3.1"}],"affected_versions":[]},{"name":{"value":"net-imap","evidence":"the bundled gem net-imap to 0.4.25"},"prerequisites":[],"fixed_versions":[{"value":"0.4.25","evidence":"the bundled gem net-imap to 0.4.25"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-41316","evidence":"CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class"},{"value":"CVE-2026-42245","evidence":"The net-imap update fixes CVE-2026-42245"},{"value":"CVE-2026-42246","evidence":"CVE-2026-42245, CVE-2026-42246"},{"value":"CVE-2026-42256","evidence":"CVE-2026-42256"},{"value":"CVE-2026-42257","evidence":"CVE-2026-42257"},{"value":"CVE-2026-42258","evidence":"CVE-2026-42258"},{"value":"CVE-2026-47240","evidence":"CVE-2026-47240"},{"value":"CVE-2026-47241","evidence":"CVE-2026-47241"},{"value":"CVE-2026-47242","evidence":"CVE-2026-47242"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19321,"advisory_id":"f7014744-52ae-48d3-b5be-43a1c13fbfc9","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/12/ruby-4-1-0-preview1-released/","source_published_at":"2026-10-12T00:00:00+00:00","published_at":"2026-10-25T02:48:22.923641+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab CVEs","summary":"Ruby releases 4.0.9, 3.4.12, and 3.3.13 fix bugs in Ruby’s regular expression engine that GitLab found could be used for attacks.","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for...","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},"prerequisites":[],"fixed_versions":[{"value":"4.0.9","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.4.12","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.3.13","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19320,"advisory_id":"f047bfc5-af0a-4a49-9668-7c65b3ec7153","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/22/ruby-4-0-8-released/","source_published_at":"2026-10-22T06:54:51+00:00","published_at":"2026-10-25T02:47:22.518248+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","summary":"Ruby 4.0.9, 3.4.12, and 3.3.13 were released to fix bugs in Ruby’s regular expression engine (Onigmo).","evidence":"They fix several bugs in Ruby’s regular expression engine (Onigmo)","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},"prerequisites":[],"fixed_versions":[{"value":"Ruby 4.0.9","evidence":"We have released Ruby 4.0.9"},{"value":"3.4.12","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.3.13","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19319,"advisory_id":"e36704a3-a880-4241-8227-7f89e41f07a8","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","source_published_at":"2026-10-23T03:11:22+00:00","published_at":"2026-10-25T02:46:23.13701+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","summary":"Ruby releases 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine bugs that can corrupt memory when compiling attacker-controlled patterns. Applications are affected only if they compile regular expressions from attacker-controlled strings.","evidence":"They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.","products":[{"name":{"value":"Ruby","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},"prerequisites":[{"value":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls","evidence":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls"}],"fixed_versions":[{"value":"4.0.9","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.4.12","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.3.13","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1)"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1)"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2)"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-89078","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89078","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-93577","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93577","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-97229","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97229","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19318,"advisory_id":"ca0db6b7-2631-49df-a8d8-a88731d67082","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/","source_published_at":"2026-10-23T03:50:27+00:00","published_at":"2026-10-25T02:43:21.263064+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.4.12 Released","summary":"Ruby 3.4.12 fixes bugs in the regular expression engine that GitLab found could be used for security issues.","evidence":"This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.4.12 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.4.12","evidence":"Ruby 3.4.12 has been released."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"GitLab’s CVE-2026-89078"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19317,"advisory_id":"82b0713b-23f7-4767-b40f-d309deddf2bb","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/","source_published_at":"2026-10-23T03:11:22+00:00","published_at":"2026-10-25T02:40:22.833852+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 4.0.9 Released","summary":"Ruby 4.0.9 includes fixes for bugs in the regular expression engine that could be used for security issues. Ruby 3.4.12 and 3.3.13 were also released with fixes.","evidence":"Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9 has been released."},"prerequisites":[],"fixed_versions":[{"value":"4.0.9","evidence":"Ruby 4.0.9 has been released."},{"value":"3.4.12","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.3.13","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19315,"advisory_id":"141b25b5-6292-4e7e-b52e-b1ec72d82e72","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/","source_published_at":"2026-10-23T04:24:46+00:00","published_at":"2026-10-25T02:32:23.015644+00:00","extraction_method":"llm","technologies":["resolv","ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-80212","CVE-2026-80213","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.3.13 Released","summary":"Ruby 3.3.13 includes security fixes, including an updated resolv gem and fixes for Regexp compilation bugs.","evidence":"Ruby 3.3.13 has been released. This release includes security fixes.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.3.13 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.3.13","evidence":"Ruby 3.3.13 has been released."}],"affected_versions":[]},{"name":{"value":"resolv","evidence":"This release updates the default gem resolv to 0.3.2"},"prerequisites":[],"fixed_versions":[{"value":"0.3.2","evidence":"This release updates the default gem resolv to 0.3.2"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-80212","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-80213","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-89078","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19323,"next_before":19315}