RHSA-2026:54416: Important: ruby:3.3 security update
Important: ruby:3.3 security update
Other sources
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.Security Fix(es): net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation (CVE-2026-47242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-default-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-docto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.5-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-bundlerto a version that resolves this vulnerability.Fixed in 2.5.22-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.7.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.7.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-irbto a version that resolves this vulnerability.Fixed in 1.13.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.7.2-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.2-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-minitestto a version that resolves this vulnerability.Fixed in 5.20.0-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-mysql2-docto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-pg-docto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 5.1.2-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.2-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-raccto a version that resolves this vulnerability.Fixed in 1.7.3-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-racc-debuginfoto a version that resolves this vulnerability.Fixed in 1.7.3-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-raketo a version that resolves this vulnerability.Fixed in 13.1.0-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 3.4.0-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 3.4.0-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-rdocto a version that resolves this vulnerability.Fixed in 6.6.3.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-rexmlto a version that resolves this vulnerability.Fixed in 3.4.4-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-rssto a version that resolves this vulnerability.Fixed in 0.3.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-test-unitto a version that resolves this vulnerability.Fixed in 3.6.1-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygem-typeprofto a version that resolves this vulnerability.Fixed in 0.21.9-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygemsto a version that resolves this vulnerability.Fixed in 3.5.22-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubygems-develto a version that resolves this vulnerability.Fixed in 3.5.22-6.module+el9.6.0+24618+75aeb29f.1 - Upgrade
Upgrade
redhat/rubyto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-bundled-gemsto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-bundled-gems-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-debugsourceto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-develto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-libsto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/ruby-libs-debuginfoto a version that resolves this vulnerability.Fixed in 3.3.12-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimalto a version that resolves this vulnerability.Fixed in 3.1.5-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-bigdecimal-debuginfoto a version that resolves this vulnerability.Fixed in 3.1.5-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-io-consoleto a version that resolves this vulnerability.Fixed in 0.7.1-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-io-console-debuginfoto a version that resolves this vulnerability.Fixed in 0.7.1-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-jsonto a version that resolves this vulnerability.Fixed in 2.7.2-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-json-debuginfoto a version that resolves this vulnerability.Fixed in 2.7.2-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-mysql2to a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debuginfoto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-mysql2-debugsourceto a version that resolves this vulnerability.Fixed in 0.5.5-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pgto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pg-debuginfoto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-pg-debugsourceto a version that resolves this vulnerability.Fixed in 1.5.4-1.module+el9.4.0+21222+faeeed2f.aa - Upgrade
Upgrade
redhat/rubygem-psychto a version that resolves this vulnerability.Fixed in 5.1.2-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-psych-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.2-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-raccto a version that resolves this vulnerability.Fixed in 1.7.3-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-racc-debuginfoto a version that resolves this vulnerability.Fixed in 1.7.3-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-rbsto a version that resolves this vulnerability.Fixed in 3.4.0-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
redhat/rubygem-rbs-debuginfoto a version that resolves this vulnerability.Fixed in 3.4.0-6.module+el9.6.0+24618+75aeb29f.1.aa - Upgrade
Upgrade
ruby:3.3to a version that resolves this vulnerability.Fixed in 3.3Patch CVE-2026-47242 - Configuration
Update Ruby (ruby:3.3 security update) to address Net::IMAP arbitrary IMAP command injection caused by improper input validation (CVE-2026-47242).
Net::IMAP input validation for IMAP command parameters = validated/escaped
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:54416?
The severity of RHSA-2026:54416 is high with a CVSS score of 7.
How do I fix RHSA-2026:54416?
To fix RHSA-2026:54416, update Ruby to the latest version provided in the security advisory.
What are the security fixes included in RHSA-2026:54416?
RHSA-2026:54416 includes a fix for arbitrary IMAP command injection due to improper input validation in net-imap.
What platforms are affected by RHSA-2026:54416?
RHSA-2026:54416 affects Ruby and its associated libraries in Red Hat environments.
What vulnerabilities does RHSA-2026:54416 address?
RHSA-2026:54416 addresses vulnerabilities related to input validation and command injection.