CVE catalog

CVE-2026-82455

Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to d

[CVE catalog]

Severity: High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Published: Aug 29, 2026, 1:47:56 PM UTC
Updated: Aug 29, 2026, 2:16:38 PM UTC
Source: [NVD] · [CVE record]

This flaw has been rejected by upstream RubyGems maintainers rubygems: RubyGems: Path Traversal vulnerability during gem extraction The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rubygems	bookworm	Not reported	vulnerable
Debian	rubygems	12	`3.3.15-2`	vulnerable
Debian	rubygems	12	`3.3.15-2+deb12u1`	vulnerable
Debian	rubygems	12	`3.4.20-1`	vulnerable
Debian	rubygems	12	`3.4.20-1~0`	vulnerable
Debian	rubygems	12	`3.6.3-1`	vulnerable
Debian	rubygems	12	`3.6.6-1`	vulnerable
Debian	rubygems	12	`3.6.7-1`	vulnerable
Debian	rubygems	12	`3.6.7-2`	vulnerable
Debian	rubygems	12	`3.6.7-3~exp1`	vulnerable
Debian	rubygems	12	`4.0.15-1`	vulnerable
Debian	rubygems	12	`4.0.15-2`	vulnerable
Debian	rubygems	12	`4.0.18-1`	vulnerable
Debian	rubygems	13	`3.6.7-2`	vulnerable
Debian	rubygems	13	`3.6.7-3~exp1`	vulnerable
Debian	rubygems	13	`4.0.15-1`	vulnerable
Debian	rubygems	13	`4.0.15-2`	vulnerable
Debian	rubygems	13	`4.0.18-1`	vulnerable
Debian	rubygems	14	`3.6.7-2`	vulnerable
Debian	rubygems	14	`3.6.7-3~exp1`	vulnerable
Debian	rubygems	14	`4.0.15-1`	vulnerable
Debian	rubygems	14	`4.0.15-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rubygems	deb	14	`4.0.15-2`	Not reported	DEBIAN-CVE-2026-82455	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[bundler]Affected
Source package: [rubygems]
Details (2)
- 2.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12
- 2.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12
[ruby-bundler]Affected
Source package: [rubygems]
Details (2)
- 2.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12
- 2.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12
[ruby-rubygems]Affected
Source package: [rubygems]
Details (2)
- 3.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12
- 3.3.15-2+deb12u1 · all · bookworm
  Affected
  nvd · rubygems · debian · bookworm; nvd · rubygems · debian · 12

[Debian 13 (Trixie)]

[bundler]Affected
Source package: [rubygems]
Details (2)
- 2.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13
- 2.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13
[ruby-bundler]Affected
Source package: [rubygems]
Details (2)
- 2.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13
- 2.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13
[ruby-rubygems]Affected
Source package: [rubygems]
Details (2)
- 3.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13
- 3.6.7-2 · all · trixie
  Affected
  nvd · rubygems · debian · 13

Observed: Oct 23, 2026, 9:33:41 PM UTC

References

[Debian Security Tracker] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]