DockerState

Home › Language runtimes › ruby › 4.0

ruby:4.0

The Ruby interpreter with gem and bundler, tag 4.0, built on Debian 13.7 (trixie). Pushed to Docker Hub 4 days ago.

Critical 17High 445Medium 1481Low 1834Unknown 41Starts as root8 platforms

430 MBdownload (compressed)
1,139 MBunpacked on disk
7filesystem layers
539packages
26,771files
docker pull ruby:4.0ruby@sha256:dd87233ce44e8362fed00a1fd590c01e3dd8f8eb0001ea4a2c8a071388e9185b

Size per platform

Compressed download size on Docker Hub for each architecture.

  • riscv64508 MB
  • i386431 MB
  • ppc64le430 MB
  • amd64430 MB
  • arm64419 MB
  • s390x397 MB
  • arm/v5387 MB
  • arm/v7369 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/lib/x86_64-linux-gnu405 MB
  • /usr/bin119 MB
  • /usr/libexec/gcc105 MB
  • /usr/share/locale94 MB
  • /usr/local/lib88 MB
  • /usr/share/doc50 MB
  • /usr/lib/gcc26 MB
  • /usr/lib/python326 MB
  • /usr/lib/python3.1326 MB
  • /usr/lib/git-core25 MB

Layers

The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 49 MB# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200'
  2. 26 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates curl gnupg netbase sq wget ; apt-get dist-clean # buildkit
  3. 68 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends git mercurial openssh-client subversion procps ; apt-get dist-clean # buildkit
  4. 237 MBRUN /bin/sh -c set -ex; apt-get update; apt-get install -y --no-install-recommends autoconf automake bzip2 default-libmysqlclient-dev dpkg-dev file g++ gcc imagemagick libbz2-dev libc6-dev libcurl4-openssl-dev libdb-dev libevent-dev libffi-dev libgdbm-dev libglib2.0-dev libgmp-dev libjpeg-dev libkrb5-dev liblzma-dev libmagickcore-dev libmagickwand-dev libmaxminddb-dev libncurses5-dev libncursesw5-dev libpng-dev libpq-dev libreadline-dev libsqlite3-dev libssl-dev libtool libwebp-dev libxml2-dev libxslt-dev libyaml-dev m
  5. 190 BRUN /bin/sh -c set -eux; mkdir -p /usr/local/etc; echo 'gem: --no-document' >> /usr/local/etc/gemrc # buildkit
  6. 50 MBRUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends dpkg-dev libgdbm-dev ruby ; rustArch=; dpkgArch="$(dpkg --print-architecture)"; case "$dpkgArch" in 'amd64') rustArch='x86_64-unknown-linux-gnu'; rustupUrl='https://static.rust-lang.org/rustup/archive/1.28.2/x86_64-unknown-linux-gnu/rustup-init'; rustupSha256='20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c' ;; 'arm64') rustArch='aarch64-unknown-linux-gnu'; rustupUrl='https://static.rust-lang.org/rustup/archive/1.28.2/aarch64-unknown-lin
  7. 143 BRUN /bin/sh -c set -eux; mkdir "$GEM_HOME"; chmod 1777 "$GEM_HOME" # buildkit

Known vulnerabilities

17Critical1 with a fix
445High156 with a fix
1481Medium260 with a fix
1834Low53 with a fix
41Unknown0 with a fix

3818 findings across 539 packages; 470 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2026-33210ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection jsoninstalled 2.18.0 ~> 2.15.2.1, ~> 2.17.1.2, >= 2.19.2
Critical CVE-2026-42216OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-42217OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
Critical CVE-2026-44172mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-49261mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd libmariadb-dev, libmariadb-dev-compat, libmariadb3, mariadb-commoninstalled 1:11.8.6-0+deb13u1 no fix yet
Critical CVE-2026-60002openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side openssh-clientinstalled 1:10.0p1-7+deb13u4 no fix yet
Critical CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free libxml2, libxml2-devinstalled 2.12.7+dfsg+really2.9.14-2.1+deb13u3 no fix yet
Critical CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2026-106565ImageMagick: ImageMagick: Denial of Service via missing end-of-file check in bzip2 images imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106567ImageMagick: ImageMagick: Denial of Service via crafted PSD file imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106573ImageMagick: ImageMagick: Denial of Service via missing limit check in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106576ImageMagick: ImageMagick: Denial of Service via crafted XMP profile imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106578ImageMagick: ImageMagick: Denial of Service via invalid memory free in MVG decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106579ImageMagick: ImageMagick: Information disclosure via security policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-106580ImageMagick: ImageMagick: Information disclosure via missing security policy check in CUT encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-107209ImageMagick: ImageMagick: Denial of Service via crafted RSVG image imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-86420ImageMagick: ImageMagick: Denial of Service due to memory budget exhaustion imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-86421ImageMagick: ImageMagick: Denial of Service via memory leak in MSL decoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93589ImageMagick: ImageMagick: Denial of Service via division by zero in FLIF encoder imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2026-93590ImageMagick: ImageMagick: Denial of Service via UHDR encoder policy bypass imagemagick, imagemagick-7-common, imagemagick-7.q16, libmagickcore-7-arch-config +9 moreinstalled 8:7.1.1.43+dfsg1-1+deb13u12 8:7.1.1.43+dfsg1-1+deb13u13
High CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3847kernel: low-privileged user privileges escalation linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-12495OpenEXR: OpenEXR: Remote Code Execution via malicious EXR file parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12839OpenEXR: OpenEXR: Remote Code Execution via Heap-based Buffer Overflow in EXR File Parsing libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-12840OpenEXR: OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39862kernel: wifi: mt76: mt7915: fix list corruption after hardware restart linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-39958kernel: iommu/s390: Make attach succeed when the device was surprise removed linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-40025kernel: f2fs: fix to do sanity check on node footer for non inode dnode linux-libc-devinstalled 6.12.113-1 no fix yet
High CVE-2025-64181openexr: Use of Uninitialized Memory inside generic_unpack libopenexr-3-1-30, libopenexr-devinstalled 3.1.13-2 no fix yet
High CVE-2025-68174kernel: Linux kernel AMD KFD: Race condition causes system crash linux-libc-devinstalled 6.12.113-1 no fix yet

Showing the 40 most severe of 1,452 distinct vulnerabilities (3818 findings, one per affected package).

Packages

Debian packages
455
Ruby gems
84

Image configuration

Base OS
Debian 13.7 (trixie)
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
—
Command
irb
Exposed ports
none
Image created
2026-10-28
amd64 digest
sha256:b3960beab0be58abe7af71f17cb5062a40ee34a8d73c7018f902b53e89e8cd5a

Other Ruby tags

ruby:4.0-slim179 MB unpacked · 81 MB downloadC 1H 43M 60L 61? 1 ruby:4.0-alpine92 MB unpacked · 50 MB downloadC 1L 1

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:b3960beab0be. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.