RLSA-2026:96068: Moderate: ruby:3.3 security, bug fix, and enhancement update

Q: Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact should be prioritized during triage?

The CVSS vector assigns High impact to confidentiality, integrity, and availability. The listed weakness types are integer overflow and double free.

Q: Which software entries are identified by the advisory?

The advisory lists rocky-linux/rubygem-mysql2 and rocky-linux/rubygem-pg in its software field.

Published Nov 9, 2026

Updated

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby: double free issue in regular expression parser (CVE-2026-89078)

ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)

ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)

ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)

Bug Fix(es) and Enhancement(s):

ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:Rocky Linux-290989)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

2 affected componentsFixes available

rocky-linux/rubygem-mysql2<0:0.5.5-3.module+el9.7.0+40032+36e56d0d

0:0.5.5-3.module+el9.7.0+40032+36e56d0d

rocky-linux/rubygem-pg<0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1

0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/rubygem-mysql2 to a version that resolves this vulnerability.
Fixed in 0:0.5.5-3.module+el9.7.0+40032+36e56d0d
Upgrade
Upgrade rocky-linux/rubygem-pg to a version that resolves this vulnerability.
Fixed in 0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1

Event History

Nov 9, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact should be prioritized during triage?

The CVSS vector assigns High impact to confidentiality, integrity, and availability. The listed weakness types are integer overflow and double free.

Which software entries are identified by the advisory?

The advisory lists rocky-linux/rubygem-mysql2 and rocky-linux/rubygem-pg in its software field.

RLSA-2026:96068: Moderate: ruby:3.3 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact should be prioritized during triage?

Which software entries are identified by the advisory?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What impact should be prioritized during triage?

Which software entries are identified by the advisory?