RHSA-2026:54393: Important: ruby:3.3 security update
Important: ruby:3.3 security update
Other sources
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.Security Fix(es): net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/ruby-default-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-docto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-bundlerto a version that resolves this vulnerability.Fixed in 2.5.22-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-irbto a version that resolves this vulnerability.Fixed in 1.13.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-minitestto a version that resolves this vulnerability.Fixed in 5.20.0-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-mysql2-docto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-docto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-raketo a version that resolves this vulnerability.Fixed in 13.1.0-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-rdocto a version that resolves this vulnerability.Fixed in 6.6.3.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-rexmlto a version that resolves this vulnerability.Fixed in 3.4.4-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-rssto a version that resolves this vulnerability.Fixed in 0.3.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-test-unitto a version that resolves this vulnerability.Fixed in 3.6.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-typeprofto a version that resolves this vulnerability.Fixed in 0.21.9-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygemsto a version that resolves this vulnerability.Fixed in 3.5.22-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygems-develto a version that resolves this vulnerability.Fixed in 3.5.22-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.5-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.7.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.7.1-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.7.2-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.2-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 5.1.2-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.2-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-raccto a version that resolves this vulnerability.Fixed in 1.7.3-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-racc-debuginfoto a version that resolves this vulnerability.Fixed in 1.7.3-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 3.4.0-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 3.4.0-7.module+el9.4.0+24628+a370c2b9.2 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.5-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.7.1-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.7.1-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.7.2-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.2-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 5.1.2-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.2-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-raccto a version that resolves this vulnerability.Fixed in 1.7.3-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-racc-debuginfoto a version that resolves this vulnerability.Fixed in 1.7.3-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 3.4.0-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 3.4.0-7.module+el9.4.0+24628+a370c2b9.2.aa - Upgrade
Upgrade
ruby:3.3to a version that resolves this vulnerability.Fixed in 3.3
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:54393?
The severity of RHSA-2026:54393 is categorized as high, with a scoring of 7.
How do I fix RHSA-2026:54393?
To fix RHSA-2026:54393, update the affected Ruby packages to the latest version provided by Red Hat.
What vulnerability does RHSA-2026:54393 address?
RHSA-2026:54393 addresses an arbitrary IMAP command injection vulnerability due to improper input validation.
Which software is affected by RHSA-2026:54393?
The affected software includes redhat/ruby, redhat/rubygem-mysql2, redhat/rubygem-pg, and others related to Ruby.
What security issues are fixed in RHSA-2026:54393?
The security fix in RHSA-2026:54393 resolves issues related to input validation and command injection vulnerabilities in Net::IMAP.