Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Ruby on CentOS may crash when decompressing data
published 2 months ago
Summary
The Ruby packages for CentOS (ruby, ruby-devel, ruby-doc, ruby-irb, ruby-libs) contain a coding error that can cause a program to stop working when it tries to read certain compressed files. This could affect any application that uses Ruby to handle gzip data. Update the Ruby packages to the latest version to fix the issue.
What to do
- Update centos ruby to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos ruby-devel to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos ruby-doc to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos ruby-irb to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos ruby-libs to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos ruby-tcltk to version 2.0.0.648-39.el7_9.tuxcare.els13.
- Update centos rubygem-bigdecimal to version 1.2.0-39.el7_9.tuxcare.els13.
- Update centos rubygem-io-console to version 0.4.2-39.el7_9.tuxcare.els13.
- Update centos rubygem-json to version 1.7.7-39.el7_9.tuxcare.els13.
- Update centos rubygem-minitest to version 4.3.2-39.el7_9.tuxcare.els13.
- Update centos rubygem-psych to version 2.0.0-39.el7_9.tuxcare.els13.
- Update centos rubygem-rake to version 0.9.6-39.el7_9.tuxcare.els13.
- Update centos rubygem-rdoc to version 4.0.0-39.el7_9.tuxcare.els13.
- Update centos rubygems to version 2.0.14.1-39.el7_9.tuxcare.els13.
- Update centos rubygems-devel to version 2.0.14.1-39.el7_9.tuxcare.els13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | ruby |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | ruby-devel |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | ruby-doc |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | ruby-irb |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | ruby-libs |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | ruby-tcltk |
< 2.0.0.648-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0.648-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-bigdecimal |
< 1.2.0-39.el7_9.tuxcare.els13 Fix: upgrade to 1.2.0-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-io-console |
< 0.4.2-39.el7_9.tuxcare.els13 Fix: upgrade to 0.4.2-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-json |
< 1.7.7-39.el7_9.tuxcare.els13 Fix: upgrade to 1.7.7-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-minitest |
< 4.3.2-39.el7_9.tuxcare.els13 Fix: upgrade to 4.3.2-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-psych |
< 2.0.0-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.0-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-rake |
< 0.9.6-39.el7_9.tuxcare.els13 Fix: upgrade to 0.9.6-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygem-rdoc |
< 4.0.0-39.el7_9.tuxcare.els13 Fix: upgrade to 4.0.0-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygems |
< 2.0.14.1-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.14.1-39.el7_9.tuxcare.els13
|
| TuxCare:CentOS:7 | centos | rubygems-devel |
< 2.0.14.1-39.el7_9.tuxcare.els13 Fix: upgrade to 2.0.14.1-39.el7_9.tuxcare.els13
|
Original advisory text
ruby: Fix of CVE-2026-27820
- CVE-2026-27820: fix buffer overflow in Zlib::GzipReader#ungetc
- Skip unresolvable GIDs in TestProcess#test_execopts_gid (build env workaround)
- Skip unresolvable GIDs in TestProcess#test_execopts_gid (build env workaround)
References
- https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1786470325.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27820 Vendor Advisory
Timeline
Published13 Aug 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1786470325 · OSV
Track software like this
Free during beta