In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade ruby-tcltkUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-libs | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby23Upgrade ruby24Upgrade ruby20 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade ruby-tcltkUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfo | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby2.5Upgrade ruby1.8Upgrade ruby1.9.1 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-psychUpgrade ruby-irbUpgrade rubygem-io-console | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-minitestUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade ruby-libsUpgrade rubyNo solution existsUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-bigdecimal | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.1-stdlibUpgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-stdlib | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby2.0Upgrade ruby1.9.1Upgrade libruby1.9.1Upgrade ruby1.9.3 | Jun 22, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub