CVE-2015-7581

High

Published: 16/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Action Pack in Ruby on Rails versions 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 has a vulnerability that allows remote attackers to cause a denial of service through the use of a wildcard controller route, leading to superfluous caching and memory consumption.

Risk Assessment

Organizations may experience availability issues with their applications, potentially leading to service interruptions and negative impacts on reputation.

Recommendation

It is recommended to upgrade Ruby on Rails to version 4.2.5.1 or 5.0.0.beta1.1 to mitigate this vulnerability.

Other vulnerabilities in Action Pack w Ruby on Rails

CVE-2016-0751High
In Action Pack in Ruby on Rails before version 3.2.22.1, and 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1, there is an issue with properly restricting the use of the MIME type cache. This allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Original NVD description (English source)

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.