{
  "document": {
    "aggregate_severity": {
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: regexp: out-of-bounds repeat stack access in Onigmo\n     when the range-repeat or null-check ID overflows its internal type\n     - debian/patches/CVE-2026-110264.patch: reject overflowed IDs\n     - CVE-2026-110264\n   * SECURITY UPDATE: regexp: wrapped jump offsets in Onigmo from an integer\n     overflow in the quantifier expansion size check and from compiled\n     programs too big for their offset type\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       expansion size by division and cap the compiled program size\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * debian/rules: run test-all for test/ruby/test_regexp.rb only; the full\n     suite aborts with a core dump after the last test on the build system",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1792797810.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-23T23:24:24Z",
      "generator": {
        "date": "2026-10-23T23:24:24Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1792797810",
      "initial_release_date": "2026-10-23T23:24:24Z",
      "revision_history": [
        {
          "date": "2026-10-23T23:24:24Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                "product": {
                  "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_id": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                "product": {
                  "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_id": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7-dev@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                "product": {
                  "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_id": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                "product": {
                  "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_id": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                "product": {
                  "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_id": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7-dev@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                "product": {
                  "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_id": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                "product": {
                  "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_id": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                "product": {
                  "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_id": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7-dev@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                "product": {
                  "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_id": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all",
                "product": {
                  "name": "ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all",
                  "product_id": "ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/ruby2.7-doc@2.7.4-1%2Bdeb11u6%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel"
        },
        "product_reference": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64"
        },
        "product_reference": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64"
        },
        "product_reference": "libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel"
        },
        "product_reference": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64"
        },
        "product_reference": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64"
        },
        "product_reference": "ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
        },
        "product_reference": "ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64"
        },
        "product_reference": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel"
        },
        "product_reference": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64"
        },
        "product_reference": "ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-110264",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-110264"
        },
        {
          "category": "external",
          "summary": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633",
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/4093475",
          "url": "https://hackerone.com/reports/4093475"
        }
      ],
      "release_date": "2026-10-22T01:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T23:23:32.232247Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810",
          "product_ids": [
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-93577",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93577"
        },
        {
          "category": "external",
          "summary": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/",
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gitlab-org/gitlab/-/work_items/629758",
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/629758"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3995696",
          "url": "https://hackerone.com/reports/3995696"
        }
      ],
      "release_date": "2026-09-24T00:17:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T23:23:32.232247Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810",
          "product_ids": [
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-97229",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
          "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
          "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97229"
        },
        {
          "category": "external",
          "summary": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
          "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/gitlab-org/gitlab/-/work_items/630686",
          "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/630686"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/4055749",
          "url": "https://hackerone.com/reports/4055749"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/4058589",
          "url": "https://hackerone.com/reports/4058589"
        }
      ],
      "release_date": "2026-10-13T02:17:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-23T23:23:32.232247Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810",
          "product_ids": [
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:libruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.amd64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.arm64",
            "Debian-11:ruby2.7-dev-0:2.7.4-1+deb11u6+tuxcare.els1.armel",
            "Debian-11:ruby2.7-doc-0:2.7.4-1+deb11u6+tuxcare.els1.all"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792797810"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    }
  ]
}