Linux · Security advisory · July 2, 2026

ELSA-2026-33576: Security update for 28 packages

ELSA-2026-33576, released July 2, 2026, fixes 3 CVEs across 28 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0078
56th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
rubyol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
ruby-bundled-gemsol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
ruby-default-gemsol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
ruby-develol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
ruby-docol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
ruby-libsol 90:3.3.10-7.module+el9.8.0+90944+8975e57f
rubygem-bigdecimalol 90:3.1.5-7.module+el9.8.0+90944+8975e57f
rubygem-bundlerol 90:2.5.22-7.module+el9.8.0+90944+8975e57f
rubygem-io-consoleol 90:0.7.1-7.module+el9.8.0+90944+8975e57f
rubygem-irbol 90:1.13.1-7.module+el9.8.0+90944+8975e57f
rubygem-jsonol 90:2.7.2-7.module+el9.8.0+90944+8975e57f
rubygem-minitestol 90:5.20.0-7.module+el9.8.0+90944+8975e57f
rubygem-mysql2ol 90:0.5.5-3.module+el9.8.0+90944+8975e57f
rubygem-mysql2-docol 90:0.5.5-3.module+el9.8.0+90944+8975e57f
rubygem-pgol 90:1.5.4-2.module+el9.8.0+90944+8975e57f
rubygem-pg-docol 90:1.5.4-2.module+el9.8.0+90944+8975e57f
rubygem-power_assertol 90:2.0.3-7.module+el9.8.0+90944+8975e57f
rubygem-psychol 90:5.1.2-7.module+el9.8.0+90944+8975e57f
rubygem-raccol 90:1.7.3-7.module+el9.8.0+90944+8975e57f
rubygem-rakeol 90:13.1.0-7.module+el9.8.0+90944+8975e57f
rubygem-rbsol 90:3.4.0-7.module+el9.8.0+90944+8975e57f
rubygem-rdocol 90:6.6.3.1-7.module+el9.8.0+90944+8975e57f
rubygem-rexmlol 90:3.4.4-7.module+el9.8.0+90944+8975e57f
rubygem-rssol 90:0.3.1-7.module+el9.8.0+90944+8975e57f
rubygem-test-unitol 90:3.6.1-7.module+el9.8.0+90944+8975e57f
rubygem-typeprofol 90:0.21.9-7.module+el9.8.0+90944+8975e57f
rubygemsol 90:3.5.22-7.module+el9.8.0+90944+8975e57f
rubygems-develol 90:3.5.22-7.module+el9.8.0+90944+8975e57f

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-42258 net-imap: Command Injection via unvalidated Symbol inputs 7.4 0.0078 None reported
High CVE-2026-42245 ruby4.0: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby 7.4 0.0041 None reported
High CVE-2026-42246 net-imap vulnerable to STARTTLS stripping via invalid response timing 7.4 0.0031 None reported
Showing 1 to 3 of 3 1