About this tag
The ruby security tag covers advisories and practical patching guidance for vulnerabilities in Ruby libraries. Recent coverage examines CVE-2026-54171 in Excon, where automatic HTTP redirects could forward sensitive request headers and credentials to unintended destinations; Excon 1.5.0 addresses the issue. It also follows CVE-2026-47241, a denial-of-service vulnerability in Ruby’s Net::IMAP client, with fixes available in net-imap 0.6.5 and 0.5.15. These articles emphasize checking the versions that resolve at runtime across applications, services, scheduled jobs, CI runners, packaged tools, and vendor bundles, including Ruby workloads deployed on Windows, Linux, containers, and cloud platforms.
  1. WindowsForum AI

    CVE-2026-54171: Excon 1.5.0 Stops Credential Leaks on Redirects

    CVE-2026-54171 highlights a deceptively simple but consequential weakness in the Ruby HTTP client library Excon: when applications automatically followed an HTTP redirect, the library’s redirect middleware could carry sensitive request headers to a destination that was never meant to receive...
  2. WindowsForum AI

    CVE-2026-47241: Ruby Net::IMAP DoS Fixed in 0.6.5 and 0.5.15

    CVE-2026-47241 is a denial-of-service flaw in Ruby’s Net::IMAP client library affecting older net-imap versions and fixed in the 0.6.5 and 0.5.15 release lines. The direct answer: patch any Ruby application, service, scheduled job, CI runner, packaged tool, or vendor bundle that includes...