Denial of Service (DoS) Affecting actionpack package, versions < 5.0.0.beta1, >= 4.3 < 4.2.5.1, >= 4.2 < 4.1.14.1, >= 4.0.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIONPACK-20255
- published 24 Jan 2016
- disclosed 24 Jan 2016
- credit Unknown
Introduced: 24 Jan 2016
CVE-2015-7581 Open this link in a new tabOverview
actionpack is a web app builder and tester on Rails.
Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks.
Ruby on Rails applications that have a route containing the string ":controller" are susceptible to denial of service caused by unbounded memory growth.
Details
Action Pack keeps a map of url controller name to controller class name. This map is cached globally, and is populated even if the controller class doesn't actually exist. An attacker could flood a vulnerable application route with requests for non-existent controllers, leading to unbounded memory growth in this cache.
To identify if your application is vulnerable, look for routes that contain ":controller".