Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygems | Dec 1, 2016 | Oct 17, 2013 |
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Oct 17, 2013 |
| Freebsd | — | Upgrade ruby19-gemsUpgrade ruby20-gems | Dec 10, 2025 | Nov 24, 2013 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1 | May 29, 2017 | Oct 17, 2013 |
| Oracle_linux | — | Upgrade rubygems | Oct 16, 2024 | Oct 17, 2013 |
| Redhat Openshift | — | Upgrade rubygems | Oct 8, 2019 | Sep 9, 2013 |
| Suse | — | Upgrade ruby19-devel-extraUpgrade ruby19-doc-riUpgrade ruby19-develUpgrade ruby19Upgrade ruby19-tk | Dec 12, 2013 | Oct 17, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub