SUMMARY

Savon::Model#all_operations generates a class-level method for every operation named in the WSDL. A WSDL operation named client normalizes to the Ruby method name :client, which overwrites Savon::Model's own internal client accessor, and since the generated method body itself calls client.call …, the method now calls itself forever and the Ruby process dies with an unhandled SystemStackError.

Impact

An application that builds a Savon::Model from a WSDL it does not fully control, calls all_operations, and later touches model.client crashes with an unhandled SystemStackError. SystemStackError is not a StandardError, so ordinary rescue blocks do not catch it and the failure usually takes the worker process down. Availability only; no confidentiality or integrity effect.