openSUSE-SU-2026:21878-1

This update for ruby3.4 fixes the following issues:

• CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016).
• CVE-2026-27820: insufficient checks in zstream_buffer_ungets can lead to a buffer overflow (bsc#1259239).
• CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).
• CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011).
• CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument (bsc#1268337).
• CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
• CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
• CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833).

Changes for ruby3.4:

• Update to 3.4.10.

• Update to 3.4.9:

• Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System

• Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue

• Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System

• Bug #21326: Instruction generation differences between parse.y and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue

• Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby

• Ruby Issue Tracking System

• Bug #21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System

• Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue

• Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System

• Bug #21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue

• Bug #21860: Process.fork: the child may deadlock on th->interrupt_lock in threadptr_interrupt_exec_cleanup - Ruby - Ruby Issue Tracking System

• Bug #21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System

• Update to 3.4.8:

  • Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System

• Bug #21626: Backport WASI setjmp handler memory leak fixes - Ruby - Ruby Issue Tracking System

• Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby Issue Tracking System

• Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) -

• Bug #21644: Stack consistency error for the newrange INSN peephole optimization with chilled string - Ruby - Ruby Issue

• Bug #21668: Improve performance of UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue

• Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby

• Bug #21652: Marshal#dump documentation out-of-date/unclear regarding Data class - Ruby - Ruby Issue Tracking System

• Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters -

• Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System

• Bug #21671: Rails CI raises Assertion Failed: rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual type: 26 with "-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" enabled -

• Update next stable version to 4.0 from 3.5 by hsbt . Pull Request #15146

• Bug #21679: Segfault when ruby calls pthread_detach in rb_getnameinfo - Ruby - Ruby Issue Tracking System

• Bug #21694: Crash when looking up super method from BasicObject

• Ruby - Ruby Issue Tracking System

• Bug #21707: Destructuring assignment of SimpleDelegator wrapped array bug with YJIT - Ruby - Ruby Issue Tracking System

• Bug #21265: Crash when proc from Symbol#to_proc called outside refinement scope - Ruby - Ruby Issue Tracking System

• Bug #21703: RUBY_CRASH_REPORT does not work when shelling out in some cases - Ruby - Ruby Issue Tracking System

• Bug #21666: Math.lgamma(-1).should == [infinity_value, 1] fails with Fedora glibc-2.42.9000-8.fc44 - Ruby - Ruby Issue Tracking System

• Bug #21655: segfault when building 3.3.10 with GCC 15.2.1, regression from 3.3.9 - Ruby - Ruby Issue Tracking System

• Bug #21680: Integer#digits bug starting from Ruby 3.1 - Ruby -

• Bug #21705: UNIXServer.open(nil) segfaults on Windows - Ruby -

• Bug #21648: [prism] ruby crashes for for * in [10]; end - Ruby

• Bug #21187: Strings concatenated with \ getting frozen with literal hashes (PRISM only) - Ruby - Ruby Issue Tracking System

• Bug #21772: ruby: YJIT has panicked StackOpnd(1) should be a heap object, but was ImmSymbol for VALUE(137647867319760) -

• Bug #21446: StackOverflow when changing visibility in reopened refinement - Ruby - Ruby Issue Tracking System

• Bug #21779: Do not export functions from statically linked extensions - Ruby - Ruby Issue Tracking System

• Bug #21266: YJIT GC safety crash with proc objects as block argument - Ruby - Ruby Issue Tracking System