Posted by usa on 28 Mar 2018
There is a out-of-memory DoS vulnerability with a large request in WEBrick bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2018-8777.
If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack.
All users running an affected release should upgrade immediately.
- Ruby 2.2 series: 2.2.9 and earlier
- Ruby 2.3 series: 2.3.6 and earlier
- Ruby 2.4 series: 2.4.3 and earlier
- Ruby 2.5 series: 2.5.0 and earlier
- Ruby 2.6 series: 2.6.0-preview1
- prior to trunk revision r62965
Thanks to Eric Wong email@example.com for reporting the issue.
- Originally published at 2018-03-28 14:00:00 (UTC)