7.8

CVE-2008-3656: ruby-lang ruby Resource Management Errors

CVSS: 7.8v2.0HighModified
Published 13-08-2008Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2008-3656 is a high (CVSS 7.8) Resource Management Errors vulnerability in ruby-lang ruby. EPSS estimates a 70.20% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
55/100
0100
High · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
70.20%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 6
DSA-1651-1DSA-1652-1RHSA-2008:0897RHSA-2026:7305RHSA-2026:7307RHSA-2026:8838

Timeline

  1. 13-08-2008
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

70.20%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 70.20% on 19-09-2026

19-09-202619-10-2026
EPSS score
70.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (ruby-lang.org)

    Maturity: unknown

  • exploit-databasedosmultipleVerified

    Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Ruby WEBrick::HTTP::DefaultFileHandler DoS

    auxiliary/dos/http/webrick_regex

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Ruby-lang1 product
  • ruby≤ 1.8.5 | 1.6.8 | 1.8.0 | 1.8.1 | 1.8.1:-9 | 1.8.2 | 1.8.2:preview2 | 1.8.2:preview3 | 1.8.2:preview4 | 1.8.3 | 1.8.3:preview1 | 1.8.3:preview2 | 1.8.3:preview3 | 1.8.4 | 1.8.4:preview1 | 1.8.4:preview2 | 1.8.4:preview3 | 1.8.5:p11 | 1.8.5:p113 | 1.8.5:p115 | 1.8.5:p12 | 1.8.5:p2 | 1.8.5:p35 | 1.8.5:preview1 | 1.8.5:preview2 | 1.8.5:preview3 | 1.8.5:preview4 | 1.8.5:preview5 | 1.8.6 | 1.8.6:p110 | 1.8.6:p114 | 1.8.6:preview1 | 1.8.6:preview2 | 1.8.6:preview3 | 1.8.7 | 1.8.7:p17 | 1.8.7:p22 | 1.8.7:p71 | 1.8.7:preview1 | 1.8.7:preview2 | 1.8.7:preview3 | 1.8.7:preview4 | 1.9.0

1 vendor · 1 product

References

30 links
Show all 30 references