RLSA-2026:96235: Moderate: ruby security, bug fix, and enhancement update

Q: Which systems should be prioritized for remediation?

Prioritize Rocky Linux systems using the Ruby package, especially where Ruby processes untrusted input or regular expressions. The listed flaws include a double free and multiple integer overflows in regular-expression parsing and compilation.

Q: Can these issues be exploited remotely without credentials or user interaction?

The advisory rates the issues as critical with CVSS 9.8 and the vector AV:N/AC:L/PR:N/UI:N. This indicates network-reachable exploitation is assessed as requiring low complexity, no privileges, and no user interaction.

Q: What security impact is indicated by the advisory?

The CVSS vector lists high confidentiality, integrity, and availability impacts. A successful exploit could therefore affect data disclosure, modification, and service availability.

Q: Which CVEs are addressed by this update?

The update addresses CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264.

Published Nov 10, 2026

Updated

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

ruby: double free issue in regular expression parser (CVE-2026-89078)

ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)

ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)

ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)

Bug Fix(es) and Enhancement(s):

ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-300972)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/ruby<0:3.3.13-16.el10_2

0:3.3.13-16.el10_2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/ruby to a version that resolves this vulnerability.
Fixed in 0:3.3.13-16.el10_2
Upgrade
Upgrade ruby to a version that resolves this vulnerability.
Patch rhel-10.2.z

Event History

Nov 10, 2026

Advisory Published

via OSV·12:09 PM

Data Sourced

via OSV·12:09 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems should be prioritized for remediation?

Prioritize Rocky Linux systems using the Ruby package, especially where Ruby processes untrusted input or regular expressions. The listed flaws include a double free and multiple integer overflows in regular-expression parsing and compilation.

Can these issues be exploited remotely without credentials or user interaction?

The advisory rates the issues as critical with CVSS 9.8 and the vector AV:N/AC:L/PR:N/UI:N. This indicates network-reachable exploitation is assessed as requiring low complexity, no privileges, and no user interaction.

What security impact is indicated by the advisory?

The CVSS vector lists high confidentiality, integrity, and availability impacts. A successful exploit could therefore affect data disclosure, modification, and service availability.

Which CVEs are addressed by this update?

The update addresses CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264.

RLSA-2026:96235: Moderate: ruby security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for remediation?

Can these issues be exploited remotely without credentials or user interaction?

What security impact is indicated by the advisory?

Which CVEs are addressed by this update?

Company

Resources

Contact

Frequently Asked Questions

Which systems should be prioritized for remediation?

Can these issues be exploited remotely without credentials or user interaction?

What security impact is indicated by the advisory?

Which CVEs are addressed by this update?