SB20261109125 - Debian update for ruby3.3
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 vulnerabilities.
1) Command injection (CVE-ID: CVE-2026-42258)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.
The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.
2) Integer overflow (CVE-ID: CVE-2026-110264)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the GitLab server.
The vulnerability exists due to integer overflow in the regular expression compiler when compiling specially crafted regular expressions. A remote attacker can supply a specially crafted regular expression to execute arbitrary code on the server.
3) Integer overflow (CVE-ID: CVE-2026-97229) Exploited
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the GitLab server.
The vulnerability exists due to integer overflow in the CI/CD regular expression compiler when processing regular expressions in CI/CD configurations. A remote attacker can supply a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server.
4) Integer overflow (CVE-ID: CVE-2026-93577)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the GitLab server.
The vulnerability exists due to an integer overflow in the regular expression compiler when compiling a specially crafted regular expression in a CI/CD configuration. A remote user can submit a specially crafted regular expression to execute arbitrary code on the GitLab server.
5) Double free (CVE-ID: CVE-2026-89078)
CWE-ID: CWE-415 - Double Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the GitLab server.
The vulnerability exists due to a double free in the regular expression parser when parsing a specially crafted regular expression in a CI/CD configuration. A remote user can submit a specially crafted regular expression to execute arbitrary code on the GitLab server.
6) Input validation error (CVE-ID: CVE-2026-80213)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname validation restrictions.
The vulnerability exists due to improper input validation in the resolv hostname resolution logic when resolving a hostname after it has been checked against an allow list or SSRF filter. A remote attacker can supply a crafted hostname so that the validated string and the name sent to the network differ to bypass hostname validation restrictions.
This requires a hostname that exceeds DNS length limits.
7) Resource exhaustion (CVE-ID: CVE-2026-80212)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the resolv DNS resolution logic when processing malicious DNS responses from an attacker-controlled name server. A remote attacker can return crafted DNS responses that are retained permanently to cause a denial of service.
Only applications that resolve hostnames an attacker can influence through this gem are affected.
8) Command injection (CVE-ID: CVE-2026-47242)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a highly privileged local attacker to inject arbitrary IMAP commands and delete mailboxes through an affected application.
The vulnerability exists due to missing argument validation in net-imap's Net::IMAP#id and Net::IMAP#enable methods when untrusted input contains command-separating CRLF sequences. A highly privileged local attacker can supply CRLF sequences followed by IMAP commands when a victim runs an application that passes attacker-controlled input to these methods.
9) Improper Neutralization of Trailing Special Elements (CVE-ID: CVE-2026-47241)
CWE-ID: CWE-162 - Improper Neutralization of Trailing Special Elements
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker to cause denial of service through hanging IMAP commands and timeouts.
The vulnerability exists due to incomplete trailing-marker validation in net-imap raw arguments when an application passes user-controlled input to affected commands. A remote authenticated attacker can supply arguments ending in {0} or {0+} for a victim to process, causing the server to absorb the next command and leave requests blocked.
10) Command injection (CVE-ID: CVE-2026-47240)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.
The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.
11) Resource exhaustion (CVE-ID: CVE-2025-24294)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling DNS packets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
12) Command injection (CVE-ID: CVE-2026-42257)
CWE-ID: CWE-77 - Command injection
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to execute arbitrary IMAP commands through an application's authenticated connection to a mail server.
The vulnerability exists due to missing validation and escaping of raw arguments in net-imap commands when an application passes unvalidated, user-controlled input to affected methods. An unprivileged local attacker can insert CRLF sequences into these arguments to inject additional commands, such as deleting mailboxes, during normal application use.
13) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42256)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to freeze an entire Ruby client process for minutes.
The vulnerability exists due to insufficient limits on PBKDF2 iteration counts in net-imap when a client authenticates to a hostile IMAP server using SCRAM-SHA1 or SCRAM-SHA256. An unauthenticated remote attacker can send an excessive iteration count in the server's authentication response, triggering expensive computation that blocks all Ruby threads in the client process.
14) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-42246)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated network attacker to bypass TLS and expose sensitive information transmitted by an IMAP client.
The vulnerability exists due to net-imap accepting an early success response during a STARTTLS upgrade of a plaintext connection without ensuring TLS is established. An unauthenticated network attacker can intercept the connection and inject a predictably tagged response before the command finishes, leaving subsequent traffic unencrypted when the client does not explicitly verify TLS.
15) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-42245)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust a net-imap client's CPU and cause a denial of service.
The vulnerability exists due to quadratic processing in Net::IMAP::ResponseReader when repeated scans of a growing response buffer process many string literals. An unauthenticated remote attacker can send crafted responses from a hostile IMAP server to a connected client, causing excessive CPU consumption even below the default max_response_size limit.
16) Improper access control (CVE-ID: CVE-2026-41316)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper access control in ERB#def_module, ERB#def_method, and ERB#def_class when deserializing untrusted data with Marshal.load. A remote attacker can supply crafted serialized data to bypass the @_init guard and execute arbitrary code.
Exploitation requires both erb and activesupport to be loaded.
17) Buffer overflow (CVE-ID: CVE-2026-27820)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to buffer overflow in zstream_buffer_ungets() function when parsing input within the Zlib::GzipReader. A remote attacker can provide crafted input that causes the buffer length to exceed its capacity to cause memory corruption.
User interaction is required.
18) Information disclosure (CVE-ID: CVE-2025-61594)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to insufficient fix for #VU105105 (CVE-2025-27221). When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked. A remote attacker can gain access to sensitive information.
19) Resource exhaustion (CVE-ID: CVE-2025-58767)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing invalid XML containing multiple XML declarations. A local attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.