{"id":"CLSA-2026-1776952176","summary":"ruby: Fix of 4 CVEs","details":"- CVE-2024-39908: fix ReDoS in REXML parser for repeated `\u003e` / character\n  reference payloads\n- CVE-2024-41123: fix ReDoS in REXML source.match when no terminator string\n  is specified\n- CVE-2024-41946: add XML entity expansion limit to REXML SAX and pull\n  parsers\n- CVE-2024-43398: fix DoS via deep elements with namespace-conflicted\n  attributes in REXML tree parser","modified":"2026-05-27T11:18:02.335491148Z","published":"2026-04-23T13:49:41Z","upstream":["CVE-2024-39908","CVE-2024-41123","CVE-2024-41946","CVE-2024-43398"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776952176.html"}],"affected":[{"package":{"name":"ruby","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ruby?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"ruby-default-gems","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ruby-default-gems?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"ruby-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ruby-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"ruby-doc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ruby-doc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"ruby-libs","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ruby-libs?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-bigdecimal","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-bigdecimal?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-bundler","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-bundler?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-io-console","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-io-console?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-irb","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-irb?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-json","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-json?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-minitest","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-minitest?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-power_assert","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-power_assert?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-psych","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-psych?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-rake","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-rake?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-rbs","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-rbs?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-rdoc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-rdoc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-rexml","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-rexml?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-rss","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-rss?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-test-unit","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-test-unit?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygem-typeprof","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygem-typeprof?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygems","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygems?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}},{"package":{"name":"rubygems-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rubygems-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_5.tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1776952176.json"}}],"schema_version":"1.7.5"}