SB2026010927 - Anolis OS update for ruby:3.3 module
Published: January 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2025-24294)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling DNS packets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Resource exhaustion (CVE-ID: CVE-2025-58767)
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing invalid XML containing multiple XML declarations. A local attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Information disclosure (CVE-ID: CVE-2025-61594)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to insufficient fix for #VU105105 (CVE-2025-27221). When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked. A remote attacker can gain access to sensitive information.
4) Information disclosure (CVE-ID: CVE-2025-27221)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to URI#join, URI#merge, and URI#+ methods retain sensitive information, such as user:password, even after the host is replaced. A remote attacker can gain access to sensitive information.
Remediation
Install update from vendor's website.