In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Apr 5, 2018 | Apr 3, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-json | Apr 27, 2020 | Apr 3, 2018 |
| Amazon_linux | — | Upgrade ruby22Upgrade ruby20Upgrade ruby24Upgrade ruby23 | May 11, 2018 | Apr 3, 2018 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Apr 3, 2018 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygemsUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-rake | Aug 28, 2019 | Apr 3, 2018 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby1.8Upgrade ruby2.5 | Aug 2, 2018 | Apr 3, 2018 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Mar 29, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jul 3, 2018 | Apr 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jul 3, 2018 | Apr 3, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Apr 3, 2018 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-tcltkUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-rake | Jul 21, 2020 | Mar 28, 2018 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby-tcltkNo solution existsUpgrade rubyUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-libs | Aug 7, 2019 | Apr 3, 2018 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.1-develUpgrade libruby2_1-2_1Upgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-devel-extraUpgrade yast2-ruby-bindingsUpgrade ruby2.1Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.1-stdlib | Jul 22, 2019 | Apr 3, 2018 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.0Upgrade ruby2.3Upgrade ruby2.0Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade libruby1.9.1 | Jun 22, 2018 | Apr 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub