Infinite loop Affecting iodine package, versions >=0.0.1.pre
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-IODINE-16073479
- published15 Apr 2026
- disclosed14 Apr 2026
- creditUnknown
Introduced: 14 Apr 2026
New CVE NOT AVAILABLE CWE-835 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
iodine is a fast HTTP / Websocket Server with built-in Pub/Sub support (with or without Redis), static file support and many other features, optimized for Ruby MRI on Linux / BSD / macOS.
Affected versions of this package are vulnerable to Infinite loop through the fio_json_parse() function. An attacker can cause the process to enter an infinite loop and exhaust CPU resources by submitting specially crafted JSON input containing a nested value starting with 'i' or 'I'.