Security
فارسی
All products

Red Hat Enterprise Linux 9/rhel9/ruby-33

Red Hat · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems High Fix reported
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 PyPIRed Hat High Fix reported
Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34763 · GHSA-7MQQ-6CF9-V2QP Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefCVE-2026-25500 · GHSA-WHRJ-4476-WVMP Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems Medium Fix reported
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 PyPIRed Hat High Fix reported
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)CVE-2025-61772 · GHSA-WPV5-97WM-HP9C Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator Red HatRubyGems High Fix reported
Possible Log Injection in Rack::CommonLoggerCVE-2025-25184 · GHSA-7G2V-JJ9Q-G3RG Logging Subsystem for Red Hat OpenShift/fluentd-rhel9Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel9 Red HatRubyGems Medium Fix reported
Possible DoS by memory exhaustion in net-imapCVE-2025-25186 · GHSA-7FC5-F82F-CX69 Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel8Red Hat Enterprise Linux 10/rhel10-beta/flatpak-sdk Red HatRubyGems Medium Fix reported
openssl: Timing side-channel in ECDSA signature computationCVE-2024-13176 Logging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8 Red Hat Low No fix reported
openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()CVE-2026-75803 Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 Red Hat Low No fix reported