Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Oct 17, 2013 |
| Freebsd | — | Upgrade ruby20-gemsUpgrade ruby19-gems | Dec 10, 2025 | Nov 24, 2013 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1 | May 29, 2017 | Oct 17, 2013 |
| Suse | — | Upgrade ruby19Upgrade ruby19-develUpgrade ruby19-tkUpgrade ruby19-devel-extraUpgrade ruby19-doc-ri | Dec 12, 2013 | Oct 17, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub