Update vulnerable Ruby gems in Datadog cookbook (multiple CVEs)

Open Beginner friendly

#970 opened on Mar 13, 2026 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 64/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Quiet
Tech stack: ruby
Domain: devops, security

Research direction

Start with /var/chef/cache/cookbooks/datadog/Gemfile.lock and compare the listed nokogiri, rack, addressable, faraday, and rexml versions with their fixed versions in the issue. Regenerate Gemfile.lock, then verify that all five gems meet the requested minimum versions and that the resulting dependency bundle is consistent.

Written by the indexing model from the issue text.

Description

Security scanning identified several vulnerable Ruby gems in the Datadog Chef cookbook dependency bundle (Gemfile.lock).

Affected file path:
/var/chef/cache/cookbooks/datadog/Gemfile.lock

The following components contain known CVEs and should be upgraded to the patched versions.

Affected Components:

Type: Ruby
Component: nokogiri
Current Version: 1.18.8
CVEs: GHSA-353f-x4gh-cqq8, GHSA-wx95-c6cv-8532
Fixed Version: 1.19.1

Type: Ruby
Component: rack
Current Version: 2.2.13
CVEs: CVE-2026-25500, CVE-2025-61770, CVE-2025-61771, CVE-2025-46727, CVE-2025-61772, CVE-2025-61919, CVE-2026-22860, CVE-2025-32441, CVE-2025-61780, CVE-2025-59830
Fixed Version: 2.2.22

Type: Ruby
Component: addressable
Current Version: 2.7.0
CVE: CVE-2021-32740
Fixed Version: 2.8.0

Type: Ruby
Component: faraday
Current Version: 1.0.1
CVE: CVE-2026-25765
Fixed Version: 1.10.5

Type: Ruby
Component: rexml
Current Version: 3.3.9
CVE: CVE-2025-58767
Fixed Version: 3.4.2

Recommended Remediation:
Update the vulnerable gems to the fixed versions and regenerate Gemfile.lock.

Suggested versions:
nokogiri >= 1.19.1
rack >= 2.2.22
addressable >= 2.8.0
faraday >= 1.10.5
rexml >= 3.4.2

Dominant language: Ruby
Stars: 100
Forks: 253
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Gateway 3.16 Linux install: GPG key URL 404s (public_keys has no "316" entry, falls back to legacy key) Open

user-reported

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

Kong/developer.konghq.com#7316 · Opened Sep 22, 2026
Semantic HTML: Further explain how landmark elements should be used Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

TheOdinProject/curriculum#31408 · Opened Sep 21, 2026
URI label indexer writes to _label_tesim instead of _tesim Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

notch8/utk_knapsack#148 · Opened Sep 21, 2026
`font-gnu-unifont` download link broken Open

Difficulty 1/5 Under an hour Newbie friendliness 78/100

Homebrew/homebrew-cask#288729 · 1 comment · Opened Sep 21, 2026
Test `FileUtils.options_of` Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

ruby/fileutils#195 · Opened Sep 21, 2026

More Ruby issues