The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-actionmailer4.2. | Aug 30, 2017 | Jul 26, 2015 |
| Debian | — | Upgrade ruby-activesupport-3.2Upgrade rails | Feb 2, 2016 | Jul 26, 2015 |
| Freebsd | — | Upgrade rubygem-activesupport4Upgrade rubygem-rackUpgrade rubygem-jquery-rails4Upgrade rubygem-rails4Upgrade rubygem-jquery-railsUpgrade rubygem-rack15Upgrade rubygem-web-consoleUpgrade rubygem-railsUpgrade rubygem-activesupportUpgrade rubygem-rack16 | Dec 10, 2025 | Jun 17, 2015 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jul 26, 2015 |
| Suse | — | Upgrade rubygem-activesupport-3_2 | Dec 18, 2015 | Jul 26, 2015 |
| Ubuntu | — | Upgrade rails | Nov 19, 2024 | Jul 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub