---
id: CVE-2020-36327
title: >-
  Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a
  dependency source based on the highest gem version number, which means that a
  rogue gem found at a public source may be chosen, even if the intended choice
  was a …
summary: >-
  Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a
  dependency source based on the highest gem version number, which means that a
  rogue gem found at a public source may be chosen, even if the intended choice
  was a …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: bundler
product: bundler
affected:
  - 'bundler >= 1.16.0, < 2.2.10'
  - 'bundler >= 2.2.11, <= 2.2.16'
  - fedora = 34
  - package_manager_configurations
patched:
  - bundler 2.2.10
published: '2021-04-29'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:30.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-36327'
references:
  - url: >-
      https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html
    label: cve@mitre.org
  - url: 'https://github.com/rubygems/rubygems/issues/3982'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/
    label: cve@mitre.org
  - url: >-
      https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/
    label: cve@mitre.org
  - url: 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105'
    label: cve@mitre.org
  - url: >-
      https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
    label: cve@mitre.org
  - url: >-
      https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/rubygems/rubygems/issues/3982'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.06307
epssPercentile: 0.9357
ingestedAt: '2026-10-08T22:11:53.732Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T21:02:42.958558Z'
---

## Overview

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

## Affected

- `bundler >= 1.16.0, < 2.2.10`
- `bundler >= 2.2.11, <= 2.2.16`
- `fedora = 34`
- `package_manager_configurations`

## Remediation

Upgrade past the affected range:

- `bundler 2.2.10`