CVE-2022-28739

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-28739
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-28739.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-28739
Aliases
Downstream
ALPINE (1)
BELL (1)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (5)
RHSA (10)
RLSA (5)
SUSE (1)
UBUNTU (1)
Related
ALSA (4)
openSUSE (5)
SUSE (1)
Published
2022-05-09T00:00:00Z
Modified
2026-08-18T14:46:30Z
Summary
[none]
Details

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28739.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "2.6.10"
                },
                {
                    "introduced":  "2.7.x"
                },
                {
                    "fixed":  "2.7.6"
                },
                {
                    "introduced":  "3.x"
                },
                {
                    "fixed":  "3.0.4"
                },
                {
                    "introduced":  "3.1.x"
                },
                {
                    "fixed":  "3.1.2"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7b4ea5bb73df1524444f2f61ab5d32e30e94b6f2
Introduced
647ee6f091eafcce70ffb75ddf7e121e192ab217
Fixed
c9c2245c0a25176072e02db9254f0e0c84c805cd
Introduced
95aff214687a5e12c3eb57d056665741e734c188
Fixed
3fa771ddedac25560be57f4055f1767e6c810f58
Introduced
fb4df44d1670e9d25aef6b235a7281199a177edb
Fixed
4491bb740a9506d76391ac44bb2fe6e483fec952
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.6.10"
        },
        {
            "introduced":  "2.7.0"
        },
        {
            "fixed":  "2.7.6"
        },
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.0.4"
        },
        {
            "introduced":  "3.1.0"
        },
        {
            "fixed":  "3.1.2"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

Other
v1_0_r2
v2_7_0
v2_7_1
v2_7_2
v2_7_3
v2_7_4
v2_7_5
v3_0_0
v3_0_1
v3_0_2
v3_0_3
v3_1_0
v3_1_1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-28739.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "328864874327574063403775378011327146659",
            "length":  8488
        },
        "id":  "CVE-2022-28739-6a62c92b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ruby/ruby/commit/3fa771ddedac25560be57f4055f1767e6c810f58",
        "target":  {
            "file":  "missing/dtoa.c",
            "function":  "strtod"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "328864874327574063403775378011327146659",
            "length":  8488
        },
        "id":  "CVE-2022-28739-9881b371",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ruby/ruby/commit/c9c2245c0a25176072e02db9254f0e0c84c805cd",
        "target":  {
            "file":  "missing/dtoa.c",
            "function":  "strtod"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "337285692131683350587106124606194849187",
                "171125667734974039822063106046701353862",
                "315160000533057727845661241951943922131",
                "27247823211488908491542581188290566144",
                "268560890618114141161195735339343855241",
                "321395545576834868767584132304880323141",
                "12924114540111067235220886822648996878",
                "18815063887966383786580032668437598724"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-28739-cd9ec724",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ruby/ruby/commit/c9c2245c0a25176072e02db9254f0e0c84c805cd",
        "target":  {
            "file":  "missing/dtoa.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "337285692131683350587106124606194849187",
                "171125667734974039822063106046701353862",
                "315160000533057727845661241951943922131",
                "27247823211488908491542581188290566144",
                "268560890618114141161195735339343855241",
                "321395545576834868767584132304880323141",
                "12924114540111067235220886822648996878",
                "18815063887966383786580032668437598724"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-28739-d67435c3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ruby/ruby/commit/3fa771ddedac25560be57f4055f1767e6c810f58",
        "target":  {
            "file":  "missing/dtoa.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-18T14:46:30Z"