CVE-2006-1931: yukihiro_matsumoto ruby

EPSS trend

Probability

10.43%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

+0.24 pp

From 10.19% on 20-09-2026

20-09-202620-10-2026

EPSS score

10.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasedoslinuxVerified
Yukihiro Matsumoto Ruby 1.x - XMLRPC Server Denial of Service
Maturity: poc

References

28 links

secunia.com/advisories/19772Third Party AdvisoryX Refsource SECUNIA
blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787X Refsource MISCPatch
secunia.com/advisories/21657Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/16904Third Party AdvisoryX Refsource SECUNIA
usn.ubuntu.com/273-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/20024Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/17645VDB EntryX Refsource BID
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11100VDB EntrySignatureX Refsource OVAL
www.novell.com/linux/security/advisories/2006-06-02.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/support/errata/RHSA-2006-0427.htmlVendor AdvisoryX Refsource REDHAT

Show all 28 references

exchange.xforce.ibmcloud.com/vulnerabilities/26102VDB EntryX Refsource XF
www.gentoo.org/security/en/glsa/glsa-200605-11.xmlVendor AdvisoryX Refsource GENTOO
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189540X Refsource CONFIRMPatch
securitytracker.com/id?1015978VDB EntryX Refsource SECTRACK
www.debian.org/security/2006/dsa-1157Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/19804Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2006:079Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/20064Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/20457Third Party AdvisoryX Refsource SECUNIA
www.osvdb.org/24972VDB EntryX Refsource OSVDB
access.redhat.com/errata/RHSA-2006:0427Advisory
www.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=189539REPORT
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0427.jsonAdvisory
access.redhat.com/security/cve/CVE-2006-1931REPORT
bugzilla.redhat.com/show_bug.cgi?id=1618072REPORT
www.cve.org/CVERecord?id=CVE-2006-1931Advisory
nvd.nist.gov/vuln/detail/CVE-2006-1931Advisory

Related vulnerabilities

CVE-2005-2337debianruby+113.26%21y ago07-10-2005 04:00Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).CVE-2005-1992debianruby1.8+96.57%21y ago20-06-2005 04:00The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands.CVE-2004-0755debianruby+90.36%22y ago19-08-2004 04:00The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.CVE-2004-0983debianruby+121.90%21y ago19-11-2004 05:00The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.CVE-2006-5467debianruby1.6+104.52%19y ago27-10-2006 18:00The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.CVE-2006-6303yukihiro_matsumotoruby3.80%19y ago06-12-2006 19:00The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.

All vulnerabilities inruby

CVE-2006-1931: yukihiro_matsumoto ruby

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References