In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-docUpgrade ruby-debuginfoUpgrade ruby | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby23Upgrade ruby22Upgrade ruby20 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade ruby-develUpgrade rubygemsUpgrade rubygems-develUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-bigdecimal | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby1.8Upgrade ruby2.5 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade ruby-libsUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-devel | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-libsUpgrade ruby-develNo solution exists | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.1Upgrade ruby2.1-stdlibUpgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade libruby2_1-2_1 | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.0Upgrade ruby2.3Upgrade libruby1.9.1Upgrade ruby2.0Upgrade ruby1.9.3Upgrade ruby1.9.1 | Jun 22, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub