ALSA-2026:96120: Moderate: ruby:4.0 security, bug fix, and enhancement update

Q: Does the advisory identify any configuration requirements or attacker prerequisites for exploitation?

No. The available advisory data identifies integer overflow issues in Ruby regular expression compilation, including CI/CD regular expression compilation, but does not specify attacker access requirements, affected configurations, or whether default deployments are exposed.

Q: How can I determine whether my environment may be in scope?

Review whether the listed AlmaLinux packages are installed: rubygem-mysql2, rubygem-mysql2-doc, rubygem-pg, and rubygem-pg-doc. The provided data does not include affected or fixed package versions, so it cannot confirm exposure from installed version information alone.

Q: Is a temporary mitigation provided if updating is not immediately possible?

No workaround or compensating control is included in the provided advisory data. The advisory describes the update as a rebase to the latest Ruby 4.0 release for RHEL 9.

Published Nov 9, 2026

Updated

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby: integer overflow issue in regular expression compiler (CVE-2026-93577) ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)

Bug Fix(es) and Enhancement(s):

ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:RHEL-260675)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

4 affected componentsFixes available

almalinux/rubygem-mysql2<0.5.7-1.module_el9.8.0+232+50f6dd36

0.5.7-1.module_el9.8.0+232+50f6dd36

almalinux/rubygem-mysql2-doc<0.5.7-1.module_el9.8.0+232+50f6dd36

0.5.7-1.module_el9.8.0+232+50f6dd36

almalinux/rubygem-pg<1.6.3-1.module_el9.8.0+232+50f6dd36

1.6.3-1.module_el9.8.0+232+50f6dd36

almalinux/rubygem-pg-doc<1.6.3-1.module_el9.8.0+232+50f6dd36

1.6.3-1.module_el9.8.0+232+50f6dd36

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/rubygem-mysql2 to a version that resolves this vulnerability.
Fixed in 0.5.7-1.module_el9.8.0+232+50f6dd36
Upgrade
Upgrade almalinux/rubygem-mysql2-doc to a version that resolves this vulnerability.
Fixed in 0.5.7-1.module_el9.8.0+232+50f6dd36
Upgrade
Upgrade almalinux/rubygem-pg to a version that resolves this vulnerability.
Fixed in 1.6.3-1.module_el9.8.0+232+50f6dd36
Upgrade
Upgrade almalinux/rubygem-pg-doc to a version that resolves this vulnerability.
Fixed in 1.6.3-1.module_el9.8.0+232+50f6dd36

Event History

Nov 9, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Does the advisory identify any configuration requirements or attacker prerequisites for exploitation?

No. The available advisory data identifies integer overflow issues in Ruby regular expression compilation, including CI/CD regular expression compilation, but does not specify attacker access requirements, affected configurations, or whether default deployments are exposed.

How can I determine whether my environment may be in scope?

Review whether the listed AlmaLinux packages are installed: rubygem-mysql2, rubygem-mysql2-doc, rubygem-pg, and rubygem-pg-doc. The provided data does not include affected or fixed package versions, so it cannot confirm exposure from installed version information alone.

Is a temporary mitigation provided if updating is not immediately possible?

No workaround or compensating control is included in the provided advisory data. The advisory describes the update as a rebase to the latest Ruby 4.0 release for RHEL 9.

ALSA-2026:96120: Moderate: ruby:4.0 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does the advisory identify any configuration requirements or attacker prerequisites for exploitation?

How can I determine whether my environment may be in scope?

Is a temporary mitigation provided if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Does the advisory identify any configuration requirements or attacker prerequisites for exploitation?

How can I determine whether my environment may be in scope?

Is a temporary mitigation provided if updating is not immediately possible?