Back to Database
Status published
High
CVE-2018-8777
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4,...
Vulnerability Description
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-8777
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/
- https://usn.ubuntu.com/3685-1/
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/
- http://www.securityfocus.com/bid/103683
- https://access.redhat.com/errata/RHSA-2018:3729
- http://www.securitytracker.com/id/1042004
- https://access.redhat.com/errata/RHSA-2018:3730
- https://lists.debian.org/debian-lts-announce/2018/04/msg00023.html
- https://access.redhat.com/errata/RHSA-2018:3731
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/
- https://www.debian.org/security/2018/dsa-4259
- https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-2-10-released/
- https://lists.debian.org/debian-lts-announce/2018/04/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
- https://access.redhat.com/errata/RHSA-2019:2028
- https://access.redhat.com/errata/RHSA-2020:0542
- https://access.redhat.com/errata/RHSA-2020:0591
- https://access.redhat.com/errata/RHSA-2020:0663
More from ruby-lang
View All →CVE-2025-27221
In the URI gem before 1.0.3 for Ruby, the URI...
Low
3.2
CVE-2025-27220
In the CGI gem before 0.4.2 for Ruby, a Regular...
Medium
4
CVE-2025-27219
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse...
Medium
5.8
CVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x...
High
7.5
CVE-2022-28738
A double free was found in the Regexp compiler in...
Critical
9.8
Affected Vendor
ruby-lang
View all reports →Affected Software
ruby, debian linux, ubuntu linux, enterprise linux
Vulnerable Versions:
2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 7.0, 8.0, 9.0, 14.04, 16.04, 17.10, 6.0, 7.4, 7.5, 7.6
Timeline
Official Publish:
April 3rd, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.