ruby vulnerabilities

CVEs per yearBy the year they were published

1. 20173
2. 20191
3. 20192
4. 20191
5. 20246
6. 20257
7. 202615

Newest CVEs

• CVE-2026-80213

  An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking…

  Ruby · resolv

  Medium4.0
• CVE-2026-80212

  An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and…

  Ruby · resolv

  High7.5
• CVE-2026-71847

  Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

  ruby · json

  High8.7
• CVE-2026-54696

  Ruby JSON: JSON generator heap buffer overflow when streaming to an IO

  ruby · json

  Low3.7
• CVE-2026-47242

  Net::IMAP: Command Injection via ID command argument

  ruby · net-imap

  Medium5.8
• CVE-2026-47240

  Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

  ruby · net-imap

  Medium5.8
• CVE-2026-47241

  Net::IMAP: Denial of Service via incomplete raw argument validation

  ruby · net-imap

  Low2.1
• CVE-2026-42258

  net-imap: Command Injection via unvalidated Symbol inputs

  ruby · net-imap

  Medium5.8
• CVE-2026-42257

  net-imap: Command Injection via "raw" arguments to multiple commands

  ruby · net-imap

  Medium5.8
• CVE-2026-42256

  net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

  ruby · net-imap

  Medium6.0