Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-3656 — Uncontrolled Resource Consumption in Ruby

CWE-399CWE-400 — Uncontrolled Resource Consumption10 documents8 sources
Severity
7.8HIGHNVD
EPSS
65.1%
top 1.52%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Ruby-lang Ruby
Timeline
PublishedAug 13
Latest updateMay 2

Description

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

CVSS vector

AV:N/AC:L/C:N/I:N/A:CExploitability: 10.0 | Impact: 6.9

Affected Packages1 packages

▶NVDruby-lang/ruby1.8.5+10

🔴Vulnerability Details

3
GHSA
GHSA-823x-6r7f-v9x6: Algorithmic complexity vulnerability in the WEBrick::HTTPUtils↗2022-05-02
▶
GHSA
WEBrick Denial of Service Vulnerability↗2022-05-02
▶
CVEList
CVE-2008-3656: Algorithmic complexity vulnerability in the WEBrick::HTTPUtils↗2008-08-13
▶

💥Exploits & PoCs

1
Exploit-DB
Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service↗2008-08-11
▶

📋Vendor Advisories

3
Red Hat
ruby: Incomplete fix for CVE-2008-3656↗2008-12-04
▶
Ubuntu
Ruby vulnerabilities↗2008-10-10
▶
Red Hat
ruby: WEBrick DoS vulnerability (CPU consumption)↗2008-08-08
▶

💬Community

2
Bugzilla
CVE-2008-4310 ruby: Incomplete fix for CVE-2008-3656↗2008-11-06
▶
Bugzilla
CVE-2008-3656 ruby: WEBrick DoS vulnerability (CPU consumption)↗2008-08-13
▶
CVE-2008-3656 — Uncontrolled Resource Consumption | cvebase