Critical Security Update for Ruby: Denial of Service and Data Disclosure in rubygem Packages
Summary
RLSA-2026:73519: Important: ruby:2.5 security update. Affects rubygem-abrt across 2 version ranges.
< 0:0.3.0-4.module+el8.5.0+738+032c9c02
< 0:0.3.0-4.module+el8.9.0+1536+5f79634e
Fixed in 0:0.3.0-4.module+el8.5.0+738+032c9c02 or 0:0.3.0-4.module+el8.9.0+1536+5f79634e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language known for its ease of use and productivity. It is widely used for web development and system management tasks. The rubygem packages, including rubygem-abrt, rubygem-bson, rubygem-bundler, rubygem-mysql2, and rubygem-pg, are essential components that facilitate various functionalities in Ruby applications. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing these packages.
Vulnerability Detail
The vulnerabilities stem from two main issues: the resolv gem is susceptible to Denial of Service (DoS) attacks due to uncontrolled memory growth when processing crafted DNS responses (CVE-2026-80212), and the MongoDB Ruby Driver is vulnerable to data disclosure and DoS through query-operator injection (CVE-2026-88030). These vulnerabilities can lead to significant disruptions in service and unauthorized access to sensitive data, making it imperative for users to address them promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update rubygem-abrt-
< 0:0.3.0-4.module+el8.5.0+738+032c9c020:0.3.0-4.module+el8.5.0+738+032c9c02 -
< 0:0.3.0-4.module+el8.9.0+1536+5f79634e0:0.3.0-4.module+el8.9.0+1536+5f79634e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing network-level protections to mitigate the risk of DoS attacks, such as rate limiting or IP whitelisting. Additionally, review and sanitize any user inputs to prevent injection attacks.
Conclusion
The identified vulnerabilities in the Ruby rubygem packages pose significant risks to applications relying on these components. It is crucial for users to update their packages to the latest patched versions to safeguard against potential attacks. By following the outlined steps and utilizing available resources, users can effectively manage their security posture.
See every vulnerability recorded for rubygem-abrt →
FAQ
The CVSS score of the vulnerability is 8.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities can lead to Denial of Service, causing application downtime, and data disclosure, risking sensitive information exposure.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to disrupt services or access sensitive data.
Implement network-level protections and review user inputs to mitigate risks until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for rubygem-abrt.
