CVE-2008-3656

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS

70.20% chance of exploitation in the next 30 days, 99th percentile

Published

2008-08-13

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/webrick_regex.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/32222

References

• CVE Record
• NVD entry

Related

• CVE-2008-3655
• CVE-2008-3657
• CVE-2008-3649
• CVE-2008-3664
• CVE-2008-3641
• CVE-2008-3667