products / ruby

Ruby

Ruby (MRI) is the reference Ruby interpreter used for Rails apps, CLI tooling, and background workers. NVD tracks it under cpe:2.3:a:ruby-lang:ruby. High-severity advisories often land in StringIO, URI parsing, and CGI cookie handling rather than the VM core.

api usage

Querying Ruby

product slugruby

version format3.0.0, 3.3.6, 2.7.8

bash

curl "https://api.attestd.io/v1/check?product=ruby&version=3.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Ruby 3.0.0 sits inside the StringIO buffer over-read and URI ReDoS ranges that affect early 3.0.x releases. The aggregated response returns risk_state high for this version.

json

{
  "product": "ruby",
  "version": "3.0.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "3.0.5",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2021-28965",
    "CVE-2021-28966",
    "CVE-2021-31810",
    "CVE-2021-32066",
    "CVE-2021-33621",
    "CVE-2021-41817",
    "CVE-2021-41819",
    "CVE-2022-28738",
    "CVE-2022-28739"
  ],
  "cves": null,
  "max_epss": 0.57133,
  "last_updated": "2026-07-13T05:12:29.591097Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Ruby 3.3.6 resolves the StringIO, float conversion, CGI cookie, and URI ReDoS lines listed below.

bash

curl "https://api.attestd.io/v1/check?product=ruby&version=3.3.6" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Ruby security releases often bundle stdlib fixes across several minor lines at once. Memory disclosure in StringIO and float conversion, cookie prefix spoofing in CGI, and ReDoS in the URI gem are the patterns that dominate recent MRI advisories.

CVE	Description	Affects	CVSS
`CVE-2024-27280`	StringIO ungetbyte/ungetc buffer over-read returns memory contents on a later gets.	3.0.x–3.0.6, 3.1.x–3.1.4	9.8
`CVE-2022-28739`	Buffer over-read in String-to-Float conversion discloses memory.	<3.0.4 / <3.1.2	7.5
`CVE-2021-41819`	CGI::Cookie.parse mishandles cookie-name security prefixes and enables cookie-prefix spoofing.	≤2.6.8 / <2.7.5 / <3.0.3	7.5
`CVE-2023-28755`	URI parser ReDoS on crafted invalid URLs increases CPU until timeout.	through 3.2.1 (vulnerable uri gem)	5.3

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD records MRI advisories under one CPE product identifier:

cpe:2.3:a:ruby-lang:rubyMRI / CRuby releases

Attestd filters keyword results through this prefix and matches semver ranges across the supported 2.x and 3.x lines.

All products Python Perl Quickstart