CVE-2024-35221 Denial of service when publishing a package on rubygems.org
A remote attacker can cause a denial of service on rubygems.org by publishing a gem with malicious YAML aliases, requiring a patch to the platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35221?
CVE-2024-35221 is a medium-severity denial of service vulnerability in rubygems.org, published on 29 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.
Weakness: CWE-400
Which versions are affected by CVE-2024-35221?
Linux distribution packages (16)
ruby2.5 SUSE:Enterprise Storage 7.1 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Manager Proxy LTS 4.3 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 SUSE:Manager Server LTS 4.3 | All versions | 2.5.9-150000.4.49.1 |
ruby2.5 openSUSE:Leap 15.6 | All versions | 2.5.9-150000.4.49.1 |
How do I fix CVE-2024-35221?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35221 being exploited?
There is no known exploitation of CVE-2024-35221 in the wild and no public exploit code.
Sources
Also known as OESA-2024-1780, OESA-2024-1938, SUSE-SU-2025:02814-1, SUSE-SU-2025:02814-2.