RLSA-2026:96120: Moderate: ruby:4.0 security, bug fix, and enhancement update

Q: What systems should be prioritized for remediation?

Prioritize Rocky Linux systems using the listed rubygem-mysql2 or rubygem-pg software, particularly where Ruby 4.0 is deployed on RHEL 9-derived environments. The update includes fixes for three integer-overflow issues in Ruby regular expression compilation.

Q: What does the supplied CVSS vector indicate about exploitation requirements?

The vector indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates potential high impact to confidentiality, integrity, and availability.

Q: Can this advisory confirm whether a default installation is vulnerable or identify the fixed package version?

No. The provided advisory data does not state whether default configurations are affected and does not provide vulnerable or fixed package version numbers.

Published Nov 9, 2026

Updated

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)

ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)

ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)

Bug Fix(es) and Enhancement(s):

ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:Rocky Linux-260675)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

2 affected componentsFixes available

rocky-linux/rubygem-mysql2<0:0.5.7-1.module+el9.8.0+40094+ce01217c

0:0.5.7-1.module+el9.8.0+40094+ce01217c

rocky-linux/rubygem-pg<0:1.6.3-1.module+el9.8.0+40094+ce01217c

0:1.6.3-1.module+el9.8.0+40094+ce01217c

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/rubygem-mysql2 to a version that resolves this vulnerability.
Fixed in 0:0.5.7-1.module+el9.8.0+40094+ce01217c
Upgrade
Upgrade rocky-linux/rubygem-pg to a version that resolves this vulnerability.
Fixed in 0:1.6.3-1.module+el9.8.0+40094+ce01217c

Event History

Nov 9, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What systems should be prioritized for remediation?

Prioritize Rocky Linux systems using the listed rubygem-mysql2 or rubygem-pg software, particularly where Ruby 4.0 is deployed on RHEL 9-derived environments. The update includes fixes for three integer-overflow issues in Ruby regular expression compilation.

What does the supplied CVSS vector indicate about exploitation requirements?

The vector indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates potential high impact to confidentiality, integrity, and availability.

Can this advisory confirm whether a default installation is vulnerable or identify the fixed package version?

No. The provided advisory data does not state whether default configurations are affected and does not provide vulnerable or fixed package version numbers.

RLSA-2026:96120: Moderate: ruby:4.0 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What systems should be prioritized for remediation?

What does the supplied CVSS vector indicate about exploitation requirements?

Can this advisory confirm whether a default installation is vulnerable or identify the fixed package version?

Company

Resources

Contact

Frequently Asked Questions

What systems should be prioritized for remediation?

What does the supplied CVSS vector indicate about exploitation requirements?

Can this advisory confirm whether a default installation is vulnerable or identify the fixed package version?