Skip to content
Fencer Vulns
high 8.1

CVE-2026-41316 json

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

published 2026-04-24 6 mo ago modified 2026-10-26 13 d ago also GHSA-q339-8rmv-2mhv , EUVD-2026-25385

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Patch / fix

  • rubygems erb 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4
  • Red Hat Red Hat Enterprise Linux 10 0:3.3.10-12.el10_1, 0:4.0.3-34.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.3.10-11.el10_0.1
  • Red Hat Red Hat Enterprise Linux 8 8100020260428163940.489197e6
  • Red Hat Red Hat Enterprise Linux 9 0:3.0.7-166.el9_7, 9070020260428163621.9, 9080020260513131334.9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:3.0.4-160.2.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.0.4-161.el9_2.3
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.0.7-162.el9_4.2, 9040020260520083544.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.0.7-165.el9_6.1, 9060020260630075016.9
  • ruby3.3 Debian 13 3.3.13-0+deb13u1

debian advisories DEBIAN-CVE-2026-41316

  • ruby RHEL 8 3.3.10-6.module+el8.10.0+24247+b74f0fb8
  • rubygems RHEL 8 3.5.22-6.module+el8.10.0+24247+b74f0fb8
  • ruby-libs RHEL 8 3.3.10-6.module+el8.10.0+24247+b74f0fb8
  • rubygem-pg RHEL 8 1.5.4-1.module+el8.10.0+21226+b78a28c4
  • rubygem-irb RHEL 8 1.13.1-6.module+el8.10.0+24247+b74f0fb8
  • rubygem-rbs RHEL 8 3.4.0-6.module+el8.10.0+24247+b74f0fb8
  • rubygem-rss RHEL 8 0.3.1-6.module+el8.10.0+24247+b74f0fb8
  • rubygem-abrt RHEL 8 0.4.0-1.module+el8.10.0+21226+b78a28c4

red hat advisories RHSA-2026:37238RHSA-2026:35834RHSA-2026:33478RHSA-2026:33462RHSA-2026:26655RHSA-2026:26312

  • ruby2.5 SLE Module for Basesystem 15 SP7 2.5.9-150700.24.11.1

suse advisories SUSE-SU-2026:3556-1

  • ruby3.4 openSUSE Leap 16.0 3.4.10-160000.1.1
  • ruby4.0 openSUSE Tumbleweed 4.0.3-1.1

opensuse advisories openSUSE-SU-2026:21878-1openSUSE-SU-2026:10609-1

  • ruby AlmaLinux 9 4.0.3-32.module_el9.8.0+251+5fdbd96b
  • rubygems AlmaLinux 9 4.0.6-32.module_el9.8.0+251+5fdbd96b
  • ruby-libs AlmaLinux 9 4.0.3-32.module_el9.8.0+251+5fdbd96b
  • rubygem-pg AlmaLinux 9 1.6.3-1.module_el9.8.0+232+50f6dd36
  • rubygem-irb AlmaLinux 9 1.16.0-32.module_el9.8.0+251+5fdbd96b
  • rubygem-rbs AlmaLinux 9 3.10.0-32.module_el9.8.0+251+5fdbd96b
  • rubygem-rss AlmaLinux 9 0.3.2-32.module_el9.8.0+251+5fdbd96b
  • rubygem-json AlmaLinux 9 2.18.0-32.module_el9.8.0+251+5fdbd96b

almalinux advisories ALSA-2026:20596ALSA-2026:20606ALSA-2026:20614ALSA-2026:18030ALSA-2026:18039ALSA-2026:18065

  • ruby4.0 Rocky Linux 10 4.0.3-34.el10_2
  • rubygem-pg Rocky Linux 9 1.6.3-1.module+el9.8.0+40094+ce01217c
  • rubygem-mysql2 Rocky Linux 9 0.5.7-1.module+el9.8.0+40094+ce01217c
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1679+61871737
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1827+16ecb9d2
  • rubygem-abrt Rocky Linux 8 0.4.0-1.module+el8.10.0+1679+61871737
  • rubygem-abrt Rocky Linux 8 0.4.0-1.module+el8.10.0+1741+bdb5b6ca
  • rubygem-abrt Rocky Linux 8 0.4.0-1.module+el8.10.0+1820+f3fffb92

rocky linux advisories RLSA-2026:20606RLSA-2026:20596RLSA-2026:20614RLSA-2026:18065RLSA-2026:18039RLSA-2026:18030

  • ruby Alpine 3.21 3.3.13-r0

alpine advisories ALPINE-CVE-2026-41316

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41316 updated cvss 8.1

erb: ERB: Arbitrary code execution via deserialization bypass

  • Red Hat CodeReady Linux Builder EUS (v.9.6) ruby-doc 3.0.7-165.el9_6.1
    fixed: vendor fix RHSA-2026:33462
  • Red Hat Enterprise Linux AppStream (v. 8) ruby 3.3.10-6.module+el8.10.0+24247+b74f0fb8, rubygems 3.5.22-6.module+el8.10.0+24247+b74f0fb8, ruby-libs 3.3.10-6.module+el8.10.0+24247+b74f0fb8, rubygem-pg 1.5.4-1.module+el8.10.0+21226+b78a28c4, rubygem-rbs 3.4.0-6.module+el8.10.0+24247+b74f0fb8, rubygem-rss 0.3.1-6.module+el8.10.0+24247+b74f0fb8, +18 more
    fixed: vendor fix RHSA-2026:20614
  • Red Hat Enterprise Linux AppStream (v. 9) ruby 3.0.7-166.el9_7, ruby-libs 3.0.7-166.el9_7, rubygems 3.2.33-166.el9_7, rubygem-irb 1.3.5-166.el9_7, rubygem-rbs 1.4.0-166.el9_7, rubygem-rss 0.2.9-166.el9_7, +59 more
    fixed: vendor fix RHSA-2026:18039
  • Red Hat Enterprise Linux AppStream (v. 10) ruby 3.3.10-12.el10_1, ruby4.0 4.0.3-34.el10_2, rubygems 3.5.22-12.el10_1, ruby-libs 3.3.10-12.el10_1, rubygem-rbs 3.4.0-12.el10_1, rubygem-rss 0.3.1-12.el10_1, +18 more
    fixed: vendor fix RHSA-2026:18065
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) ruby 3.0.4-160.2.el9_0, ruby-libs 3.0.4-160.2.el9_0, rubygems 3.2.33-160.2.el9_0, rubygem-irb 1.3.5-160.2.el9_0, rubygem-rbs 1.4.0-160.2.el9_0, rubygem-rss 0.2.9-160.2.el9_0, +13 more
    fixed: vendor fix RHSA-2026:20670
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) ruby 3.0.4-161.el9_2.3, ruby-libs 3.0.4-161.el9_2.3, rubygems 3.2.33-161.el9_2.3, rubygem-irb 1.3.5-161.el9_2.3, rubygem-rbs 1.4.0-161.el9_2.3, rubygem-rss 0.2.9-161.el9_2.3, +13 more
    fixed: vendor fix RHSA-2026:35834
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) ruby 3.0.7-162.el9_4.2, ruby-libs 3.0.7-162.el9_4.2, rubygems 3.2.33-162.el9_4.2, rubygem-irb 1.3.5-162.el9_4.2, rubygem-rbs 1.4.0-162.el9_4.2, rubygem-rss 0.2.9-162.el9_4.2, +36 more
    fixed: vendor fix RHSA-2026:26312
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby 3.3.10-11.el10_0.1, rubygems 3.5.22-11.el10_0.1, ruby-libs 3.3.10-11.el10_0.1, rubygem-rbs 3.4.0-11.el10_0.1, rubygem-rss 0.3.1-11.el10_0.1, rubygem-irb 1.13.1-11.el10_0.1, +15 more
    fixed: vendor fix RHSA-2026:33478
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby 3.0.7-165.el9_6.1, ruby-libs 3.0.7-165.el9_6.1, rubygems 3.2.33-165.el9_6.1, rubygem-irb 1.3.5-165.el9_6.1, rubygem-rbs 1.4.0-165.el9_6.1, rubygem-rss 0.2.9-165.el9_6.1, +36 more
    fixed: vendor fix RHSA-2026:33462
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ruby-doc 3.0.7-166.el9_7
    fixed: vendor fix RHSA-2026:18039
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc 3.3.10-12.el10_1, ruby4.0-doc 4.0.3-34.el10_2
    fixed: vendor fix RHSA-2026:18065
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc 3.3.10-11.el10_0.1
    fixed: vendor fix RHSA-2026:33478
  • Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk Red Hat Enterprise Linux 7 ruby, ruby-irb, rubygems, ruby-libs, ruby-tcltk, rubygem-json, +6 more Red Hat Enterprise Linux 8 ruby:2.5/ruby Red Hat Hardened Images ruby3.3, ruby3.4, ruby4.0
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems erb
<4.0.3.1
>=4.0.4, <4.0.4.1
>=5.0.0, <6.0.1.1
>=6.0.2, <6.0.4
4.0.3.1
4.0.4.1
6.0.1.1
6.0.4

Affected products

  • ruby erb
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.