HCE3-SA-2025-0151 Important HCE 3.0 Security Fix(es): In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. (CVE-2025-27221) A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service. (CVE-2025-0306) An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier_x27;s position is "Webrick should not be used in production." (CVE-2024-47220) Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client_x27;s receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5. (CVE-2025-43857) In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. (CVE-2025-27220) REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between _ and x...; in a hex numeric character reference (_x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. (CVE-2024-49761) In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies. (CVE-2025-27219) Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`_x27;s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client_x27;s receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory. (CVE-2025-25186) HCE 3.0 rubygems-3.4.10-147.r6.hce3.noarch.rpm rubygems-devel-3.4.10-147.r6.hce3.noarch.rpm rubygem-bigdecimal-3.1.3-147.r6.hce3.x86_64.rpm rubygem-did_you_mean-1.6.3-147.r6.hce3.noarch.rpm rubygem-io-console-0.6.0-147.r6.hce3.x86_64.rpm rubygem-json-2.6.3-147.r6.hce3.x86_64.rpm rubygem-minitest-5.16.3-147.r6.hce3.noarch.rpm rubygem-openssl-3.1.0-147.r6.hce3.x86_64.rpm rubygem-psych-5.0.1-147.r6.hce3.x86_64.rpm rubygem-rake-13.0.6-147.r6.hce3.noarch.rpm rubygem-rbs-2.8.2-147.r6.hce3.x86_64.rpm rubygem-rdoc-6.5.0-147.r6.hce3.noarch.rpm rubygem-rexml-3.2.5-147.r6.hce3.noarch.rpm rubygem-rss-0.2.9-147.r6.hce3.noarch.rpm rubygem-test-unit-3.5.7-147.r6.hce3.noarch.rpm rubygem-typeprof-0.21.3-147.r6.hce3.noarch.rpm ruby-3.2.2-147.r6.hce3.x86_64.rpm ruby-bundled-gems-3.2.2-147.r6.hce3.x86_64.rpm ruby-devel-3.2.2-147.r6.hce3.x86_64.rpm ruby-help-3.2.2-147.r6.hce3.noarch.rpm ruby-irb-3.2.2-147.r6.hce3.noarch.rpm rubygem-bigdecimal-3.1.3-147.r6.hce3.aarch64.rpm rubygem-io-console-0.6.0-147.r6.hce3.aarch64.rpm rubygem-json-2.6.3-147.r6.hce3.aarch64.rpm rubygem-openssl-3.1.0-147.r6.hce3.aarch64.rpm rubygem-psych-5.0.1-147.r6.hce3.aarch64.rpm rubygem-rbs-2.8.2-147.r6.hce3.aarch64.rpm ruby-3.2.2-147.r6.hce3.aarch64.rpm ruby-bundled-gems-3.2.2-147.r6.hce3.aarch64.rpm ruby-devel-3.2.2-147.r6.hce3.aarch64.rpm