Updated advisory posts against rubysec/ruby-advisory-db@150311a

Author: jasnow

advisories/_posts/2023-08-08-CVE-2023-37463.md

@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2023-37463 (commonmarker): Several quadratic complexity bugs may lead
+  to denial of service in Commonmarker'
+comments: false
+categories:
+- commonmarker
+advisory:
+  gem: commonmarker
+  cve: 2023-37463
+  ghsa: 7vh7-fw88-wj87
+  url: https://nvd.nist.gov/vuln/detail/CVE-2023-37463
+  title: Several quadratic complexity bugs may lead to denial of service in Commonmarker
+  date: 2023-08-08
+  description: |-
+    ## Impact
+
+    Several quadratic complexity bugs in commonmarker's underlying
+    [`cmark-gfm`](https://github.com/github/cmark-gfm) library may
+    lead to unbounded resource exhaustion and subsequent denial of service.
+
+    The following vulnerabilities were addressed:
+
+    * [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)
+
+    For more information, consult the release notes for version
+    [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).
+
+    ## Mitigation
+
+    Users are advised to upgrade to commonmarker version
+    [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).
+  cvss_v3: 7.5
+  patched_versions:
+  - ">= 0.23.10"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-37463
+    - https://rubygems.org/gems/commonmarker/versions/0.23.10
+    - https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12
+    - https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7
+    - https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87
+    - https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5
+    - https://github.com/advisories/GHSA-7vh7-fw88-wj87
+  notes: "- cvss_v3 came from nvd.nist.gov URL.\n"
+---

advisories/_posts/2026-02-27-CVE-2026-2302.md

@@ -0,0 +1,47 @@
+---
+layout: advisory
+title: 'CVE-2026-2302 (mongoid): Mongoid::Criteria.from_hash method allows arbitrary
+  method calls'
+comments: false
+categories:
+- mongoid
+advisory:
+  gem: mongoid
+  cve: 2026-2302
+  ghsa: 68xj-h57p-gg5j
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-2302
+  title: Mongoid::Criteria.from_hash method allows arbitrary method calls
+  date: 2026-02-27
+  description: |-
+    Under specific conditions when processing a maliciously crafted
+    value of type Hash r, Mongoid::Criteria.from_hash may allow for
+    executing arbitrary Ruby code.
+  cvss_v3: 6.5
+  cvss_v4: 6.9
+  patched_versions:
+  - "~> 7.6.1"
+  - "~> 8.0.12"
+  - "~> 8.1.12"
+  - ">= 9.0.10"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-2302
+    - https://github.com/mongodb/mongoid/releases/tag/v9.0.10
+    - https://github.com/mongodb/mongoid/pull/6099
+    - https://rubygems.org/gems/mongoid/versions/8.1.12 - https://github.com/mongodb/mongoid/releases/tag/v8.1.12
+      - https://github.com/mongodb/mongoid/pull/6100
+    - https://rubygems.org/gems/mongoid/versions/8.0.12 - https://github.com/mongodb/mongoid/releases/tag/v8.0.12
+      - https://github.com/mongodb/mongoid/pull/6101
+    - https://rubygems.org/gems/mongoid/versions/7.6.1 - https://github.com/mongodb/mongoid/releases/tag/v7.6.1
+      - https://github.com/mongodb/mongoid/pull/6102
+    - https://github.com/mongodb/mongoid/pull/6087
+    - https://github.com/mongodb/mongoid/pull/6086
+    - https://github.com/mongodb/mongoid/pull/6085
+    - https://github.com/mongodb/mongoid/pull/6084
+    - https://github.com/mongodb/mongoid/pull/6083
+    - https://jira.mongodb.org/browse/MONGOID-5919
+    - https://github.com/advisories/GHSA-68xj-h57p-gg5j
+  notes: |
+    - GHSA is unreviewed.
+    - date from nvd.nist.gov URL.
+---

advisories/_posts/2026-07-02-CVE-2026-38969.md

@@ -0,0 +1,31 @@
+---
+layout: advisory
+title: 'CVE-2026-38969 (webrick): ruby webrick through v1.9.2 WEBrick reparses trailer'
+comments: false
+categories:
+- webrick
+advisory:
+  gem: webrick
+  cve: 2026-38969
+  ghsa: h4w6-wx8r-p68v
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-38969
+  title: ruby webrick through v1.9.2 WEBrick reparses trailer
+  date: 2026-07-02
+  description: |-
+    ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length
+    into canonical request state, enabling request smuggling.
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-38969
+    - https://github.com/ruby/webrick/pull/199
+    - https://github.com/ruby/webrick/issues/198
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-7519
+    - https://github.com/advisories/GHSA-h4w6-wx8r-p68v
+  notes: |2
+
+    - Not patched (last release was 1.9.2)
+      - https://rubygems.org/gems/webrick/versions/1.9.2
+      - https://github.com/ruby/webrick/releases/tag/v1.9.2
+    - No CVSS value in nvd.nist.gov URL.
+    - GHSA is unreviewed.
+---