- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.ruby-lang.org
Products and areas 12
- IO, process spawning and every path where a Ruby string becomes a shell command or a filesystem path
- Marshal and every other core path that reconstructs a Ruby object from bytes
- Memory management, covering the garbage collector, object allocation and the C API that native extensions use to touch both
- RubyGems and Bundler as shipped, covering registry communication, gem installation and any build step a gem can declare
- String, array and hash handling in the C source, and the encoding machinery underneath strings
- The C extension API and anything a native gem can do to interpreter invariants
- The default and bundled standard library gems, including net-imap, net-http, uri, resolv, cgi, rexml, psych, openssl and json
- The dynamic evaluation surface: eval, instance_eval, send and the metaprogramming entry points that turn a string into executing code
- The interpreter core: the parser, the compiler, the YARV virtual machine and the object system
- The programme accepts vulnerabilities in the Ruby interpreter through either published channel and states plainly that it carries no money. It declares no component carve-out, so CRuby as shipped, including the gems each release bundles, is the target
- The Ractor and Fiber concurrency machinery and whatever isolation it is meant to provide
- The regular-expression engine and the pattern-compilation path, including the behaviour that produces catastrophic backtracking
Out of scope (6)
- Distribution packaging and distro-specific patches rather than upstream CRuby
- JRuby, TruffleRuby and other implementations, which are separate projects
- Rails and other frameworks, each with its own security process
- Ruby application code with an injection bug of its own, as distinct from an interpreter defect
- Running untrusted Ruby source deliberately, since the interpreter ships no sandbox
- Third-party gems that a Ruby release does not bundle
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Two channels, either is fine: the HackerOne programme at hackerone.com/ruby, or email to the address on the policy page with the published PGP key
-
Name the exact ruby version and say whether the defect is in the interpreter or in a bundled gem.
-
Rails is a separate project with its own security process. A Rails bug is not a Ruby bug
-
Say what the attacker controls: a source file, a string handed to a core method, or a network response parsed by a bundled gem
-
For a memory-safety finding, say whether it reproduces on a distribution build or only on an upstream build, since distributions carry their own patches
-
Hold the detail until the advisory is up.
Not accepted
-
Rails and other frameworks, each with its own security process
-
Third-party gems that a Ruby release does not bundle
-
Distribution packaging and distro-specific patches rather than upstream CRuby
-
Ruby application code with an injection bug of its own, as distinct from an interpreter defect
-
Running untrusted Ruby source deliberately, since the interpreter ships no sandbox
-
JRuby, TruffleRuby and other implementations, which are separate projects
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-97229 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | Critical 10.0 | 13 Oct 2026 |
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-base | High 8.1 | 22 May 2026 |
| CVE-2026-42258 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4. | Medium 5.8 | 9 May 2026 |
| CVE-2026-42245 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in v | Low 2.3 | 9 May 2026 |
| CVE-2026-42246 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4. | High 7.6 | 9 May 2026 |
| CVE-2026-42256 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been pa | Medium 6.0 | 9 May 2026 |
| CVE-2026-42257 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP comma | Medium 5.8 | 9 May 2026 |
| CVE-2026-27820 | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existin | Low 1.7 | 16 Apr 2026 |
| CVE-2026-33210 | Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. | High 8.3 | 20 Mar 2026 |
| CVE-2025-61594 | URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable | Low 2.1 | 30 Dec 2025 |
| CVE-2025-58767 | REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities. | Low 1.2 | 17 Sep 2025 |
| CVE-2025-6442 | Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing | Medium 5.9 | 25 Jun 2025 |
| CVE-2025-43857 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiv | Medium 6.0 | 28 Apr 2025 |
| CVE-2025-27788 | JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available. | High 7.5 | 12 Mar 2025 |
| CVE-2025-27219 | In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies. | Medium 5.8 | 4 Mar 2025 |
| CVE-2025-27220 | In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. | Medium 4.0 | 4 Mar 2025 |
| CVE-2025-27221 | In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. | Low 3.2 | 4 Mar 2025 |
| CVE-2024-49761 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. | Medium 6.6 | 28 Oct 2024 |
| CVE-2024-43398 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not | Medium 5.9 | 22 Aug 2024 |
| CVE-2024-41946 | REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability. | Medium 5.3 | 1 Aug 2024 |
| CVE-2024-41123 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. | Medium 5.3 | 1 Aug 2024 |
| CVE-2024-39908 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should av | Medium 4.3 | 16 Jul 2024 |
| CVE-2024-35176 | REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs. | Medium 5.3 | 16 May 2024 |
| CVE-2024-26142 | Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. | High 7.5 | 27 Feb 2024 |
| CVE-2023-36617 | A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. | Medium 5.3 | 29 Jun 2023 |
| CVE-2023-28755 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1. | Medium 5.3 | 31 Mar 2023 |
| CVE-2023-28756 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. | Medium 5.3 | 31 Mar 2023 |
| CVE-2023-22795 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerabilit | High 7.5 | 9 Feb 2023 |
| CVE-2021-33621 | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. | High 8.8 | 18 Nov 2022 |
| CVE-2016-2338 | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow. | Critical 9.8 | 29 Sep 2022 |
| CVE-2022-28739 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. | High 7.5 | 9 May 2022 |
| CVE-2022-28738 | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations. | Critical 9.8 | 9 May 2022 |
| CVE-2021-41816 | CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby. | Critical 9.8 | 6 Feb 2022 |
| CVE-2021-41819 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. | High 7.5 | 1 Jan 2022 |
| CVE-2021-41817 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. | High 7.5 | 1 Jan 2022 |
| CVE-2021-32066 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." | High 7.4 | 1 Aug 2021 |
| CVE-2021-31799 | In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename. | High 7.0 | 30 Jul 2021 |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. | High 7.5 | 30 Jul 2021 |
| CVE-2021-31810 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). | Medium 5.8 | 13 Jul 2021 |
| CVE-2021-28965 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. | High 7.5 | 21 Apr 2021 |
| CVE-2020-25613 | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack. | High 7.5 | 6 Oct 2020 |
| CVE-2020-10933 | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter. | Medium 5.3 | 4 May 2020 |
| CVE-2020-10663 | The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that | High 7.5 | 28 Apr 2020 |
| CVE-2020-5247 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response s | Medium 6.5 | 28 Feb 2020 |
| CVE-2020-8130 | There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. | Medium 6.4 | 24 Feb 2020 |
| CVE-2015-1855 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. | Medium 5.9 | 29 Nov 2019 |
| CVE-2019-16201 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network. | High 7.5 | 26 Nov 2019 |
| CVE-2019-16254 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vec | Medium 5.3 | 26 Nov 2019 |
| CVE-2019-16255 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. | High 8.1 | 26 Nov 2019 |
| CVE-2019-15845 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. | Medium 6.5 | 26 Nov 2019 |
| CVE-2011-4121 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism. | Critical 9.8 | 26 Nov 2019 |
| CVE-2011-3624 | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header. | Medium 5.3 | 26 Nov 2019 |
| CVE-2013-1945 | ruby193 uses an insecure LD_LIBRARY_PATH setting. | Low 3.3 | 31 Oct 2019 |
| CVE-2019-11879 | The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem. | Medium 5.5 | 10 May 2019 |
| CVE-2018-16395 | An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a cha | Critical 9.8 | 16 Nov 2018 |
| CVE-2018-16396 | An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. | High 8.1 | 16 Nov 2018 |
| CVE-2018-8777 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption). | High 7.5 | 3 Apr 2018 |
| CVE-2018-8778 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure. | High 7.5 | 3 Apr 2018 |
| CVE-2018-8779 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket. | High 7.5 | 3 Apr 2018 |
| CVE-2018-8780 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed. | Critical 9.1 | 3 Apr 2018 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 11 Last 12 months Memory safety 35 % Parsing/validation 30 % Denial of service 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Ruby's reference interpreter is the runtime under Rails, GitLab, Metasploit, Homebrew, Vagrant, Discourse and Jekyll, and it ships in most Linux distributions and on macOS. Eleven CVEs came out of it across 2025 and 2026, published on ruby-lang.org rather than as GitHub advisories, so the record is easy to miss if you only watch GHSA feeds. Intake is hosted on HackerOne, and the programme page states in writing that it is a disclosure programme without monetary rewards. The email channel to the security team is equivalent and equally unpaid. sorona.xyz pays you directly on qualified, reproduced findings. In scope The programme accepts vulnerabilities in the Ruby interpreter through either published channel and states plainly that it carries no money. It declares no component carve-out, so CRuby as shipped, including the gems each release bundles, is the target The interpreter core: the parser, the compiler, the YARV virtual machine and the object system Memory management, covering the garbage collector, object allocation and the C API that native extensions use to touch both String, array and hash handling in the C source, and the encoding machinery underneath strings The regular-expression engine and the pattern-compilation path, including the behaviour that produces catastrophic backtracking Marshal and every other core path that reconstructs a Ruby object from bytes The default and bundled standard library gems, including net-imap , net-http , uri , resolv , cgi , rexml , psych , openssl and json The C extension API and anything a native gem can do to interpreter invariants RubyGems and Bundler as shipped, covering registry communication, gem installation and any build step a gem can declare The dynamic evaluation surface: eval , instance_eval , send and the metaprogramming entry points that turn a string into executing code IO, process spawning and every path where a Ruby string becomes a shell command or a filesystem path The Ractor and Fiber concurrency machinery and whatever isolation it is meant to provide Out of scope Rails and other frameworks, each with its own security process Third-party gems that a Ruby release does not bundle Distribution packaging and distro-specific patches rather than upstream CRuby Ruby application code with an injection bug of its own, as distinct from an interpreter defect Running untrusted Ruby source deliberately, since the interpreter ships no sandbox JRuby, TruffleRuby and other implementations, which are separate projects Most-valued findings Memory corruption in the C interpreter reachable from ordinary Ruby. On a Rails host that is remote code execution inside the application process Defects in the bundled network gems. net-imap , net-http , resolv and uri all parse responses from servers the application did not write, and they ship with every interpreter Marshal and deserialisation reaching object instantiation or method dispatch, the highest-severity shape this language produces Regular-expression handling that turns a user-supplied pattern or subject into unbounded CPU, since Ruby web applications routinely match against request data Parser and encoding defects where a length or an offset computed under one encoding is applied to a buffer in another RubyGems and Bundler supply-chain defects: install-time code execution, resolution confusion or verification that can be bypassed Anything that escapes the intended boundary of eval and the metaprogramming surface, given how much production Ruby passes strings into it Defects in rexml , psych and json , the bundled parsers that applications point at untrusted documents Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Two channels, either is fine: the HackerOne programme at hackerone.com/ruby, or email to [email protected] with the published PGP key The programme page states that this is a disclosure programme without monetary rewards. Ignore any bounty figure the platform's own metadata shows, because it is a stale default the written policy overrides Advisories are published on ruby-lang.org/en/security rather than as GitHub advisories on ruby/ruby , so track the fix there Name the exact ruby version and say whether the defect is in the interpreter or in a bundled gem. Bundled gems are versioned and released separately from the interpreter Rails is a separate project with its own security process. A Rails bug is not a Ruby bug Say what the attacker controls: a source file, a string handed to a core method, or a network response parsed by a bundled gem For a memory-safety finding, say whether it reproduces on a distribution build or only on an upstream build, since distributions carry their own patches Disclosure Coordinated either through HackerOne or the security mailing address, and published as an advisory on ruby-lang.org alongside patched releases across the supported version lines. The 2025 and 2026 record runs to eleven advisories through that channel. Distributions rebuild quickly once the release lands, so the embargo runs to the coordinated release date. Hold the detail until the advisory is up. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability