# cve.now: Ruby

The newest entries naming Ruby as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-80213](https://cve.now/CVE-2026-80213.md): An issue was discovered in the resolv gem before 0.7.2 for Ruby. (CVSS 4.0)
- [CVE-2026-80212](https://cve.now/CVE-2026-80212.md): An issue was discovered in the resolv gem before 0.7.2 for Ruby. (CVSS 7.5)
- [CVE-2026-71847](https://cve.now/CVE-2026-71847.md): Ruby JSON: JSON::ResumableParser#partial\_value dereferences a freed input buffer and crashes on truncated duplicate-key streams (CVSS 8.7)
- [CVE-2026-54696](https://cve.now/CVE-2026-54696.md): Ruby JSON: JSON generator heap buffer overflow when streaming to an IO (CVSS 3.7)
- [CVE-2026-47242](https://cve.now/CVE-2026-47242.md): Net::IMAP: Command Injection via ID command argument (CVSS 5.8)
- [CVE-2026-47240](https://cve.now/CVE-2026-47240.md): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument (CVSS 5.8)
- [CVE-2026-47241](https://cve.now/CVE-2026-47241.md): Net::IMAP: Denial of Service via incomplete raw argument validation (CVSS 2.1)
- [CVE-2026-42258](https://cve.now/CVE-2026-42258.md): net-imap: Command Injection via unvalidated Symbol inputs (CVSS 5.8)
- [CVE-2026-42257](https://cve.now/CVE-2026-42257.md): net-imap: Command Injection via "raw" arguments to multiple commands (CVSS 5.8)
- [CVE-2026-42256](https://cve.now/CVE-2026-42256.md): net-imap: Denial of service via high iteration count for \`SCRAM-\*\` authentication (CVSS 6.0)
- [CVE-2026-42245](https://cve.now/CVE-2026-42245.md): net-imap: Quadratic complexity when reading response literals (CVSS 2.3)
- [CVE-2026-42246](https://cve.now/CVE-2026-42246.md): net-imap vulnerable to STARTTLS stripping via invalid response timing (CVSS 7.6)
- [CVE-2026-41316](https://cve.now/CVE-2026-41316.md): ERB has an @\_init deserialization guard bypass via def\_module / def\_method / def\_class (CVSS 8.1)
- [CVE-2026-27820](https://cve.now/CVE-2026-27820.md): zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption (CVSS 1.7)
- [CVE-2026-33210](https://cve.now/CVE-2026-33210.md): Ruby JSON has a format string injection vulnerability (CVSS 8.3)
- [CVE-2025-61594](https://cve.now/CVE-2025-61594.md): URI Credential Leakage Bypass over CVE-2025-27221 (CVSS 2.1)
- [CVE-2025-58767](https://cve.now/CVE-2025-58767.md): REXML has a DoS condition when parsing malformed XML file (CVSS 1.2)
- [CVE-2025-24294](https://cve.now/CVE-2025-24294.md): The attack vector is a potential Denial of Service (DoS). (CVSS 7.5)
- [CVE-2025-6442](https://cve.now/CVE-2025-6442.md): Ruby WEBrick read\_header HTTP Request Smuggling Vulnerability (CVSS 6.5)
- [CVE-2025-43857](https://cve.now/CVE-2025-43857.md): net-imap rubygem vulnerable to possible DoS by memory exhaustion (CVSS 6.0)
- [CVE-2025-27788](https://cve.now/CVE-2025-27788.md): Ruby JSON Parser has Out-of-bounds Read (CVSS 7.5)
- [CVE-2025-25186](https://cve.now/CVE-2025-25186.md): Net::IMAP vulnerable to possible DoS by memory exhaustion (CVSS 6.5)
- [CVE-2024-49761](https://cve.now/CVE-2024-49761.md): REXML ReDoS vulnerability (CVSS 6.6)
- [CVE-2024-43398](https://cve.now/CVE-2024-43398.md): REXML denial of service vulnerability (CVSS 5.9)
- [CVE-2024-41946](https://cve.now/CVE-2024-41946.md): REXML DoS vulnerability (CVSS 5.3)
- [CVE-2024-41123](https://cve.now/CVE-2024-41123.md): REXML DoS vulnerability (CVSS 5.3)
- [CVE-2024-39908](https://cve.now/CVE-2024-39908.md): Denial of service in REXML (CVSS 4.3)
- [CVE-2024-35176](https://cve.now/CVE-2024-35176.md): REXML contains a denial of service vulnerability (CVSS 5.3)
- [CVE-2015-1855](https://cve.now/CVE-2015-1855.md): verify\_certificate\_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does no (no CVSS)
- [CVE-2011-3624](https://cve.now/CVE-2011-3624.md): Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forw (no CVSS)
- [CVE-2013-6461](https://cve.now/CVE-2013-6461.md): Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits (no CVSS)
- [CVE-2013-6460](https://cve.now/CVE-2013-6460.md): Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents (no CVSS)
- [CVE-2016-2339](https://cve.now/CVE-2016-2339.md): An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. (no CVSS)
- [CVE-2016-2337](https://cve.now/CVE-2016-2337.md): Type confusion exists in \_cancel\_eval Ruby's TclTkIp class method. (no CVSS)
- [CVE-2016-2336](https://cve.now/CVE-2016-2336.md): Type confusion exists in two methods of Ruby's WIN32OLE class, ole\_invoke and ole\_query\_interface. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ruby
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.