OPENSUSE-SU-2026:21878-1: ruby3.4&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:21878-1 is a vulnerability in ruby3.4&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 25-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for ruby3.4 This update for ruby3.4 fixes the following issues: - CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016). - CVE-2026-27820: insufficient checks in `zstream_buffer_ungets` can lead to a buffer overflow (bsc#1259239). - CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441). - CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011). - CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument (bsc#1268337). - CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338). - CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339). - CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833). Changes for ruby3.4: - Update to 3.4.10. - Update to 3.4.9: - Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System - Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue - Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System - Bug #21326: Instruction generation differences between parse.y and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue - Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby - Ruby Issue Tracking System - Bug #21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System - Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue - Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System - Bug #21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue - Bug #21860: Process.fork: the child may deadlock on th->interrupt_lock in threadptr_interrupt_exec_cleanup - Ruby - Ruby Issue Tracking System - Bug #21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System - Update to 3.4.8: - Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System - Bug #21626: Backport WASI setjmp handler memory leak fixes - Ruby - Ruby Issue Tracking System - Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby Issue Tracking System - Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) - - Bug #21644: Stack consistency error for the newrange INSN peephole optimization with chilled string - Ruby - Ruby Issue - Bug #21668: Improve performance of UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue - Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby - Bug #21652: Marshal#dump documentation out-of-date/unclear regarding Data class - Ruby - Ruby Issue Tracking System - Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters - - Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System - Bug #21671: Rails CI raises Assertion Failed: rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual type: 26 with "-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" enabled - - Update next stable version to 4.0 from 3.5 by hsbt . Pull Request #15146 - Bug #21679: Segfault when ruby calls pthread_detach in rb_getnameinfo - Ruby - Ruby Issue Tracking System - Bug #21694: Crash when looking up super method from BasicObject - Ruby - Ruby Issue Tracking System - Bug #21707: Destructuring assignment of SimpleDelegator wrapped array bug with YJIT - Ruby - Ruby Issue Tracking System - Bug #21265: Crash when proc from Symbol#to_proc called outside refinement scope - Ruby - Ruby Issue Tracking System - Bug #21703: RUBY_CRASH_REPORT does not work when shelling out in some cases - Ruby - Ruby Issue Tracking System - Bug #21666: Math.lgamma(-1).should == [infinity_value, 1] fails with Fedora glibc-2.42.9000-8.fc44 - Ruby - Ruby Issue Tracking System - Bug #21655: segfault when building 3.3.10 with GCC 15.2.1, regression from 3.3.9 - Ruby - Ruby Issue Tracking System - Bug #21680: Integer#digits bug starting from Ruby 3.1 - Ruby - - Bug #21705: UNIXServer.open(nil) segfaults on Windows - Ruby - - Bug #21648: [prism] ruby crashes for for * in [10]; end - Ruby - Bug #21187: Strings concatenated with \ getting frozen with literal hashes (PRISM only) - Ruby - Ruby Issue Tracking System - Bug #21772: ruby: YJIT has panicked StackOpnd(1) should be a heap object, but was ImmSymbol for VALUE(137647867319760) - - Bug #21446: StackOverflow when changing visibility in reopened refinement - Ruby - Ruby Issue Tracking System - Bug #21779: Do not export functions from statically linked extensions - Ruby - Ruby Issue Tracking System - Bug #21266: YJIT GC safety crash with proc objects as block argument - Ruby - Ruby Issue Tracking System

No weakness data has been published for this record.