CVE-2016-0751
HighSummary
In Action Pack in Ruby on Rails before version 3.2.22.1, and 4.0.x, 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1, there is an issue with properly restricting the use of the MIME type cache. This allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Risk Assessment
Attackers can exploit this vulnerability to cause high memory consumption, leading to denial of service in the application. This may affect the availability of services for users.
Recommendation
It is recommended to update Ruby on Rails to the latest version to mitigate this vulnerability. Additionally, monitor HTTP headers for potential attack attempts.
Other vulnerabilities in Action Pack w Ruby on Rails
Original NVD description (English source)
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.