activesupport vulnerable to Denial of Service via large XML document depth
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Mar 31, 2025
Package
Affected versions
>= 4.0.0.beta1, < 4.1.11
>= 4.2.0.beta1, < 4.2.2
< 3.2.22
Patched versions
4.1.11
4.2.2
3.2.22
Description
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Mar 31, 2025
Credits
-
levpachmanov Analyst
The (1)
jdom.rband (2)rexml.rbcomponents in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.References