In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade ruby-develUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-docUpgrade ruby | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby24Upgrade ruby22Upgrade ruby20 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade ruby-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade ruby-tcltk | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby2.5Upgrade ruby1.8Upgrade ruby1.9.1 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-rdoc | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade ruby-libsUpgrade ruby-develUpgrade rubyUpgrade ruby-docNo solution existsUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-tcltk | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.1Upgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-devel | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade ruby1.9.3Upgrade ruby2.0Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade libruby2.0Upgrade libruby2.3Upgrade ruby2.3 | Jun 22, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub