ADVISORIES
GEM
SEVERITY
CVSS v3.x: 8.6 (High)
PATCHED VERSIONS
- >= 2.5.0
DESCRIPTION
rack-contrib prior to version 2.5.0 is vulnerable to a Denial of Service
via the profiler_runs HTTP request parameter.
Versions Affected: < 2.5.0 Fixed Versions: >= 2.5.0
Impact
An attacker can trigger a Denial of Service by sending an HTTP request with
an overly large profiler_runs parameter.
curl "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.