Ruby vulnerabilities and fixes

CVEs that mention Ruby, ranked by priority. 17 tracked.

Ruby has 17 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-08-07. Highest priority: CVE-2023-22795 (score 57/100).

• CVE-2023-22795 HIGH 7.5 UPGRADE MITIGATE A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-M
• CVE-2026-49158 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
• CVE-2026-66748 HIGH 8.8 Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that a
• CVE-2026-67431 HIGH 8.3 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
• CVE-2026-54603 HIGH 8.6 OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC)
• CVE-2026-71847 HIGH 8.7 Ruby JSON is a JSON implementation for Ruby
• CVE-2026-53510 HIGH 8.1 Savon is a Ruby SOAP client
• CVE-2026-67432 HIGH 7.5 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
• CVE-2026-54659 MEDIUM 6.9 Pagy is agnostic pagination in plain Ruby
• CVE-2026-67430 MEDIUM 5.3 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
• CVE-2026-54605 HIGH 7.2 OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers
• CVE-2026-63118 MEDIUM 6.9 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
• CVE-2026-54522 MEDIUM 5.4 UPGRADE MessagePack for Ruby is an implementation of the MessagePack binary serialization format
• CVE-2026-63119 MEDIUM 6.2 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
• CVE-2026-48122 MEDIUM 5.4 Ruby LSP is an implementation of the language server protocol for Ruby
• CVE-2026-54619 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database
• CVE-2026-54620 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database

FAQ

How do I fix Ruby vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Ruby being exploited right now?

None of the tracked Ruby CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Ruby CVE should I patch first?

CVE-2023-22795 currently ranks highest (57/100): A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-M.

← Back to latest CVEs