Critical Security Update for ruby4.0: Addressing Denial of Service and Code Execution Vulnerabilities
Summary
ALSA-2026:20606: Important: ruby4.0 security update. Affects ruby4.0 versions < 4.0.3-34.el10_2. Fixed in 4.0.3-34.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web applications and system management tasks. The ruby4.0 package provides the core Ruby language features, while ruby4.0-devel includes development tools and libraries. The recent vulnerabilities identified in ruby4.0 can lead to severe security risks, including denial of service and arbitrary code execution, necessitating immediate attention from developers and system administrators.
Vulnerability Detail
The vulnerabilities in ruby4.0 stem from issues in the JSON and ERB libraries. Specifically, CVE-2026-33210 allows for denial of service or information disclosure through format string injection in the Ruby JSON library. Additionally, CVE-2026-41316 permits arbitrary code execution due to a deserialization bypass in the ERB library. These vulnerabilities can be exploited by attackers to disrupt services or execute malicious code, posing significant risks to applications relying on this version of Ruby.
How To Fix
Minimum fixed version
4.0.3-34.el10_2
This is the first release that contains the fix.
sudo dnf update ruby4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the affected services or implementing input validation to mitigate the risk of exploitation until the packages can be updated.
Conclusion
The vulnerabilities in ruby4.0 pose significant risks that can lead to denial of service and arbitrary code execution. It is essential for users to update to the patched versions of the affected packages promptly. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby4.0 →
FAQ
The main vulnerabilities are a denial of service or information disclosure via format string injection in the JSON library and arbitrary code execution via deserialization bypass in the ERB library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider implementing input validation and restricting access to the affected services as a temporary workaround.
Versions prior to 4.0.3-34.el10_2 are affected by these vulnerabilities.
More information can be found on the CVE pages for CVE-2026-33210 and CVE-2026-41316, which provide detailed insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for ruby4.0.
