CVE-2009-1904 Denial of service in n/a

What is CVE-2009-1904?

CVE-2009-1904 is a medium-severity denial of service vulnerability in Ruby-Lang Ruby, published on 11 Jun 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

Weakness: CWE-189

Which versions are affected by CVE-2009-1904?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2009-1904?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2009-1904 being exploited?

There is no known exploitation of CVE-2009-1904 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-prwc-wj59-8vwr.