Bug 2461369 (CVE-2026-41316)

Summary:	CVE-2026-41316 erb: ERB: Arbitrary code execution via deserialization bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	eshamard, jvasik, kaycoth, rblanco, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source code, which were not properly guarded against deserialization attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2463216
Bug Blocks:

Description OSIDB Bzimport 2026-04-24 03:01:40 UTC

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Comment 4 errata-xmlrpc 2026-05-18 12:16:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:18039 https://access.redhat.com/errata/RHSA-2026:18039

Comment 5 errata-xmlrpc 2026-05-18 12:43:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:18065 https://access.redhat.com/errata/RHSA-2026:18065

Comment 6 errata-xmlrpc 2026-05-18 13:02:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:18030 https://access.redhat.com/errata/RHSA-2026:18030

Comment 7 errata-xmlrpc 2026-05-26 05:16:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:20606 https://access.redhat.com/errata/RHSA-2026:20606

Comment 8 errata-xmlrpc 2026-05-26 07:14:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:20596 https://access.redhat.com/errata/RHSA-2026:20596

Comment 9 errata-xmlrpc 2026-05-26 07:16:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:20614 https://access.redhat.com/errata/RHSA-2026:20614

Comment 10 errata-xmlrpc 2026-05-26 07:17:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:20670 https://access.redhat.com/errata/RHSA-2026:20670

Comment 11 errata-xmlrpc 2026-06-16 13:27:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:26312 https://access.redhat.com/errata/RHSA-2026:26312

Comment 12 errata-xmlrpc 2026-06-17 16:44:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:26655 https://access.redhat.com/errata/RHSA-2026:26655

Comment 14 errata-xmlrpc 2026-06-30 10:49:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:33462 https://access.redhat.com/errata/RHSA-2026:33462

Comment 15 errata-xmlrpc 2026-06-30 11:24:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:33478 https://access.redhat.com/errata/RHSA-2026:33478