CVE-2018-1000075: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2...

Security readout for executives and security teams

This issue can make affected RubyGems processing get stuck in an infinite loop when handling a malformed gem tar header. The business impact is availability: build, deployment, or package-management workflows using vulnerable RubyGems could hang or consume resources. The source bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in systems running the affected Ruby/RubyGems versions, especially CI, build servers, developer workstations, and servers that install or inspect gem packages. Distribution packages may differ, so confirm against vendor advisories for Debian, Ubuntu, Red Hat, and other maintained platforms. Treat this as a patching and resilience issue, not an emergency absent local exposure or exploitation evidence. Prioritize systems that support production releases, automated deployments, or shared developer infrastructure because a hang there can disrupt delivery. Mitigation focus: Upgrade RubyGems to 2.7.6 or a vendor-patched package.; Apply relevant Debian, Ubuntu, Red Hat, or distribution security updates.; Reduce processing of untrusted gem packages where practical..

Prepared

Jun 7, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.