Potential command injection in `Shell#[]` and `Shell#test` #327512 Valid Command and Code Injection – 2019-10-16 – 1 HTTP header can split /[\r\n]/ instead of /\r\n/ #331984 Valid No weakness recorded – 2019-10-25 – 1 Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML #235842 Valid Memory Corruption – 2017-10-25 – 3 Null character at fnmatch #449617 Valid No weakness recorded – 2019-10-16 – 3 Response splitting vulnerability in WEBrick #153794 Valid Cross-site Scripting – 2018-04-29 – 4 Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault #198927 Valid Memory Corruption – 2017-10-25 – 4 Escape sequence injection vulnerability in WEBrick BasicAuth #223363 Valid Command and Code Injection – 2017-09-15 – 5 ReDoS in Time.rfc2822 #1485501 Valid No weakness recorded – 2023-05-16 – 5 CGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装 #1204977 Valid Injection and Smuggling – 2022-11-24 – 6 Buffer underflow in sprintf #192127 Valid Memory Corruption – 2017-03-05 – 7 public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053] #209251 Valid Authentication – 2017-03-29 – 7 OS Command Injection in 'rdoc' documentation generator #1161691 Valid Command and Code Injection – 2021-07-13 – 7 Ruby is shipping a vulnerable jQuery #519061 Valid No weakness recorded – 2019-10-03 – 8 Code Injection Bug Report #745921 Valid Command and Code Injection – 2021-05-07 – 8 RubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩する #1204695 Valid Injection and Smuggling – 2022-11-24 – 8 Arbitrary heap exposure in JSON.generate #209949 Valid Memory Corruption – 2017-09-25 – 9 lib/net/ftp.rb: trusting PASV responses allow client abuse #1145454 Valid Information Disclosure – 2021-07-08 – 9 SMTP command injection #137631 Valid Command and Code Injection – 2016-06-30 – 10 imap: StartTLS stripping attack (CVE-2016-0772). #1178562 Valid Cryptography – 2021-07-08 – 10 OpenSSL::X509::Name Equality Check Does Not Work, Patch included #387250 Valid Cryptography – 2018-10-19 – 11 controlled buffer under-read in pack_unpack_internal() #298246 Valid Memory Corruption – 2018-03-30 – 12 StringIO strio_getline() can divulge arbitrary memory #144482 Valid Memory Corruption – 2016-06-21 – 13 The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters. #302338 Valid Access Control – 2018-04-01 – 13 Writable RubyCi Amazon s3 bucket #207053 Valid Authentication – 2017-02-27 – 14 Open S3 Bucket WriteAble To Any Aws User #209223 Valid Authentication – 2017-03-29 – 14 Unintentional file creation caused at Tempfile with directory traversal #302298 Valid Access Control – 2018-04-01 – 15 Arbitrary heap overread in strscan on 32 bit Ruby, patch included #166661 Valid Information Disclosure – 2016-11-17 – 17 Ruby OpenSSL Library - IV Reuse in GCM Mode #170548 Valid No weakness recorded – 2021-03-07 – 17 Unix domain socket and a path containing a null character #302997 Valid Access Control – 2018-03-31 – 17 WEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS) #661722 Valid Denial of Service – 2019-11-15 – 17 sprintf combined format string attack #212241 Valid Memory Corruption – 2017-09-22 – 18 Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON) #706934 Valid Input Validation and Logic – 2020-04-23 – 20 Round-trip instability in REXML #1104077 Valid No weakness recorded – 2021-04-15 – 20 Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXML #2666849 Valid Denial of Service Medium 2025-02-20 – 21 URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoS #1444501 Valid No weakness recorded – 2023-12-13 – 22 Ruby: Heap Overflow in Floating Point Parsing #499 Valid No weakness recorded – 2013-11-22 – 26 ReDoS in Psych #1487889 Valid No weakness recorded – 2025-07-08 – 26 NET::Ftp allows command injection in filenames #294462 Valid Command and Code Injection – 2017-12-19 – 28 ReDoS in IPAddr #1485717 Valid No weakness recorded – 2025-07-08 – 32 Command injection in Pathname #449482 Valid Command and Code Injection – 2019-04-01 – 36 RCE by parsing `.rdoc_options` in RDoc #1187477 Valid Command and Code Injection – 2024-07-03 – 41 Potential HTTP Request Smuggling in ruby webrick #965267 Valid Injection and Smuggling – 2020-10-29 – 53 Path traversal in Tempfile on windows OS due to unsanitized backslashes #1131465 Valid File and Path Handling – 2021-04-07 – 54 OS Command Injection via egrep in Rake::FileList #651518 Valid Command and Code Injection – 2019-08-29 – 62