CVE-2022-28739

Name of the Vulnerable Software and Affected Versions Ruby versions 2.6.0 through 2.6.9 Ruby versions 2.7.x through 2.7.5 Ruby versions 3.0.0 through 3.0.3 Ruby versions 3.1.0 through 3.1.1

Description The issue is related to a buffer over-read in Ruby, specifically in String-to-Float conversion, including Kernel#Float and String#to f. This can potentially allow a remote attacker to cause a denial of service. The vulnerability occurs due to a memory corruption issue.

Recommendations For Ruby versions 2.6.0 through 2.6.9, update to version 2.6.10 or later. For Ruby versions 2.7.x through 2.7.5, update to version 2.7.6 or later. For Ruby versions 3.0.0 through 3.0.3, update to version 3.0.4 or later. For Ruby versions 3.1.0 through 3.1.1, update to version 3.1.2 or later.