The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-actionmailer4.2. | Aug 30, 2017 | Jul 26, 2015 |
| Debian | — | Upgrade railsUpgrade ruby-activesupport-3.2 | Feb 2, 2016 | Jul 26, 2015 |
| Freebsd | — | Upgrade rubygem-activesupportUpgrade rubygem-rack15Upgrade rubygem-railsUpgrade rubygem-web-consoleUpgrade rubygem-rack16Upgrade rubygem-rails4Upgrade rubygem-jquery-rails4Upgrade rubygem-jquery-railsUpgrade rubygem-rackUpgrade rubygem-activesupport4 | Dec 10, 2025 | Jun 17, 2015 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jul 26, 2015 |
| Suse | — | Upgrade rubygem-activesupport-3_2 | Dec 18, 2015 | Jul 26, 2015 |
| Ubuntu | — | Upgrade rails | Nov 19, 2024 | Jul 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub