UpHeron
All vulnerabilities

Servers and applications

CVE-2014-6438

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Severity
High 7.5
Published
6 Sept 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • Every version up to 1.9.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-6438
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-6438