Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 754
Alerts This Week
Warning Icon 1 754

SUSE: ruby2.5 Important DoS & Smuggling Fixes 2025:4264-1

suse
Calendar Grey November 26, 2025
Dist Suse Esm H88
Security update addressing significant issues in ruby2.5, including critical DoS vulnerabilities and other important fixes.
* bsc#1225905 * bsc#1230930 * bsc#1232440 * bsc#1235773 * bsc#1237804

Summary

## This update for ruby2.5 fixes the following issues: * CVE-2024-35221: Fixed remote DoS via YAML manifest (bsc#1225905) * CVE-2024-47220: Fixed HTTP request smuggling in WEBrick (bsc#1230930) * CVE-2024-49761: Fixed ReDOS vulnerability by updating REXML to 3.3.9 (bsc#1232440) * CVE-2025-24294: Fixed denial of service (DoS) caused by an insufficient check on the length of a decompressed domain name within a DNS packet in resolv gem (bsc#1246430) * CVE-2025-27219: Fixed denial of service in CGI::Cookie.parse (bsc#1237804) * CVE-2025-27220: Fixed ReDoS in CGI::Util#escapeElement (bsc#1237806) * CVE-2025-27221: Fixed userinfo leakage in URI#join, URI#merge and URI#+ (bsc#1237805) * CVE-2025-6442: Fixed ruby WEBrick read_header HTTP request smuggling vulnerability (bsc#1245254)

Topics%20covered

Topics Covered

security advisory denial of service SuSE important ruby http request smuggling

References

* bsc#1225905

* bsc#1230930

* bsc#1232440

* bsc#1235773

* bsc#1237804

* bsc#1237805

* bsc#1237806

* bsc#1245254

* bsc#1246430

Cross-

* CVE-2024-35221

* CVE-2024-47220

* CVE-2024-49761

* CVE-2025-24294

* CVE-2025-27219

* CVE-2025-27220

* CVE-2025-27221

* CVE-2025-6442

CVSS scores:

* CVE-2024-35221 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

* CVE-2024-47220 ( SUSE ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

* CVE-2024-47220 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

* CVE-2024-47220 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2024-49761 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-49761 ( NVD ): 6.6

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:4264-1
Release Date: 2025-11-26T15:52:48Z
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service SuSE important ruby http request smuggling

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.