SB20261109149 - Anolis OS update for ruby:3.3 module
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2026-27820)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to buffer overflow in zstream_buffer_ungets() function when parsing input within the Zlib::GzipReader. A remote attacker can provide crafted input that causes the buffer length to exceed its capacity to cause memory corruption.
User interaction is required.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-42256)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to freeze an entire Ruby client process for minutes.
The vulnerability exists due to insufficient limits on PBKDF2 iteration counts in net-imap when a client authenticates to a hostile IMAP server using SCRAM-SHA1 or SCRAM-SHA256. An unauthenticated remote attacker can send an excessive iteration count in the server's authentication response, triggering expensive computation that blocks all Ruby threads in the client process.
3) Command injection (CVE-ID: CVE-2026-42257)
CWE-ID: CWE-77 - Command injection
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to execute arbitrary IMAP commands through an application's authenticated connection to a mail server.
The vulnerability exists due to missing validation and escaping of raw arguments in net-imap commands when an application passes unvalidated, user-controlled input to affected methods. An unprivileged local attacker can insert CRLF sequences into these arguments to inject additional commands, such as deleting mailboxes, during normal application use.
4) Command injection (CVE-ID: CVE-2026-47240)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.
The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.
5) Improper Neutralization of Trailing Special Elements (CVE-ID: CVE-2026-47241)
CWE-ID: CWE-162 - Improper Neutralization of Trailing Special Elements
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker to cause denial of service through hanging IMAP commands and timeouts.
The vulnerability exists due to incomplete trailing-marker validation in net-imap raw arguments when an application passes user-controlled input to affected commands. A remote authenticated attacker can supply arguments ending in {0} or {0+} for a victim to process, causing the server to absorb the next command and leave requests blocked.
6) Command injection (CVE-ID: CVE-2026-47242)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a highly privileged local attacker to inject arbitrary IMAP commands and delete mailboxes through an affected application.
The vulnerability exists due to missing argument validation in net-imap's Net::IMAP#id and Net::IMAP#enable methods when untrusted input contains command-separating CRLF sequences. A highly privileged local attacker can supply CRLF sequences followed by IMAP commands when a victim runs an application that passes attacker-controlled input to these methods.
Remediation
Install update from vendor's website.