Read the docs
TI-2024-18119 Aliases CVE-2024-27280GHSA-v5h6-c2hv-hv3r

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x…

Priority MEDIUM 53CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02364 83rd percentileScored 2026-11-07
Fix Partial stringio (RubyGems): 3.0.1.1Red Hat: 7 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—stringio (RubyGems)before 3.0.1.13.0.1.1Patch availableGHSA-v5h6-c2hv-hv3r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • stringio (RubyGems) Vendor— Affected before 3.0.1.1 Fixed in 3.0.1.1 Patch available GHSA-v5h6-c2hv-hv3r

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:-:*:*:*:*:*:*:*not specified by CISA-ADP—ruby
  • cpe:2.3:a:ruby-lang:ruby:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·ruby

Remediation

  • Fix · GHSA-v5h6-c2hv-hv3r stringio (RubyGems) Fixed in 3.0.1.1 Advisory →

Red Hat 7 advisories

  • RHSA-2024:4499 Released 2024-07-11 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.aarch64::ruby:2.5, ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.i686::ruby:2.5, ruby-2.5.9-112.module+el8.10.0+22021+135c76a8.ppc64le::ruby:2.5 +47
  • RHSA-2024:3838 Released 2024-06-11 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-162.el9_4, ruby-default-gems-3.0.7-162.el9_4, ruby-devel-3.0.7-162.el9_4 +18
    • Red Hat Enterprise Linux CRB (v. 9) ruby-doc-3.0.7-162.el9_4
  • RHSA-2024:3671 Released 2024-06-06 · Red Hat rating Moderate
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.1-2.module+el9.4.0+21859+16f07581.aarch64::ruby:3.3, ruby-3.3.1-2.module+el9.4.0+21859+16f07581.i686::ruby:3.3, ruby-3.3.1-2.module+el9.4.0+21859+16f07581.ppc64le::ruby:3.3 +47
Show 4 more Red Hat advisories
  • RHSA-2024:3670 Released 2024-06-06 · Red Hat rating Moderate
    ruby:3.3 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.aarch64::ruby:3.3, ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.i686::ruby:3.3, ruby-3.3.1-2.module+el8.10.0+21860+47fbda2a.ppc64le::ruby:3.3 +47
  • RHSA-2024:3668 Released 2024-06-06 · Red Hat rating Moderate
    ruby:3.1 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.aarch64::ruby:3.1, ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.i686::ruby:3.1, ruby-3.1.5-144.module+el9.4.0+21780+79b7bdb5.ppc64le::ruby:3.1 +47
  • RHSA-2024:3546 Released 2024-06-03 · Red Hat rating Moderate
    ruby:3.1 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.aarch64::ruby:3.1, ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.i686::ruby:3.1, ruby-3.1.5-143.module+el8.10.0+21792+e2f63d26.ppc64le::ruby:3.1 +47
  • RHSA-2024:3500 Released 2024-05-30 · Red Hat rating Moderate
    ruby:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.aarch64::ruby:3.0, ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.i686::ruby:3.0, ruby-3.0.7-143.module+el8.10.0+21858+d19f3934.ppc64le::ruby:3.0 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3500, RHSA-2024:3546, RHSA-2024:3670, RHSA-2024:4499
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:3668, RHSA-2024:3671, RHSA-2024:3838
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:3838
Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27280
  2. 2026-10-03 Alias added: GHSA-v5h6-c2hv-hv3r

References

Advisory 1

Other 14

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences