Check your version
ruby -vCVEs affecting 2.0
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-14064 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.gen... | 9.8 | — | 2017-09-01 | |
| CVE-2017-9225 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 9.8 | — | 2017-05-25 | |
| CVE-2018-8780 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir... | 9.1 | — | 2018-04-04 | |
| CVE-2017-10784 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2... | 8.8 | — | 2017-09-20 | |
| CVE-2015-7551 | The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2... | 8.4 | — | 2016-03-24 | |
| CVE-2020-25613 | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple... | 7.5 | — | 2020-10-06 | |
| CVE-2021-28965 | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly ad... | 7.5 | — | 2021-04-21 | |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a p... | 7.5 | — | 2021-07-28 | |
| CVE-2021-41819 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CG... | 7.5 | — | 2022-01-01 | |
| CVE-2022-28739 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.... | 7.5 | — | 2022-05-09 | |
| CVE-2017-9229 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 7.5 | — | 2017-05-25 | |
| CVE-2009-5147 | DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries... | 7.3 | — | 2017-03-29 | |
| CVE-2013-4073 | The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9... | 6.8 | — | 2013-08-18 | |
| CVE-2013-4164 | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview... | 6.8 | — | 2013-11-24 | |
| CVE-2020-5247 | HTTP Response Splitting in Puma | 6.5 | — | 2020-02-29 | |
| CVE-2013-2065 | (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not per... | 6.4 | — | 2013-11-03 | |
| CVE-2015-9096 | Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL... | 6.1 | — | 2017-06-13 | |
| CVE-2015-1855 | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6,... | 5.9 | — | 2019-11-30 | |
| CVE-2014-2734 | The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reope... | 5.8 | — | 2014-04-25 | |
| CVE-2021-31810 | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP ser... | 5.8 | — | 2021-07-13 | |
| CVE-2019-16254 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program... | 5.3 | — | 2019-11-26 | |
| CVE-2023-28756 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishan... | 5.3 | — | 2023-03-31 | |
| CVE-2012-4522 | The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allo... | 5.0 | — | 2012-11-25 | |
| CVE-2012-5371 | Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting... | 5.0 | — | 2012-11-28 | |
| CVE-2013-1821 | lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of s... | 5.0 | — | 2013-04-10 | |
| CVE-2012-4464 | Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass s... | 5.0 | — | 2013-04-26 | |
| CVE-2012-4466 | Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-d... | 5.0 | — | 2013-04-26 | |
| CVE-2014-8080 | The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remot... | 5.0 | — | 2014-11-04 | |
| CVE-2014-4975 | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when usin... | 5.0 | — | 2014-11-16 | |
| CVE-2014-8090 | The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x befor... | 5.0 | — | 2014-11-22 | |
| CVE-2015-3900 | RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when f... | 5.0 | — | 2015-06-24 | |
| CVE-2013-0256 | darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly gen... | 4.3 | — | 2013-03-01 | |
| CVE-2013-4287 | Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems b... | 4.3 | — | 2013-10-18 | |
| CVE-2013-4363 | Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in R... | 4.3 | — | 2013-10-18 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).