CVE-2015-7581

Published: Feb 16, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Affected (41)

Products: Rubyonrails: Rails

Rubyonrails

1 product

Rails

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	Version 4.0.0
Rubyonrails Rails	Version 4.0.0 beta
Rubyonrails Rails	Version 4.0.0 rc1
Rubyonrails Rails	Version 4.0.0 rc2
Rubyonrails Rails	Version 4.0.10 rc1
Rubyonrails Rails	Version 4.0.1
Rubyonrails Rails	Version 4.0.1 rc1
Rubyonrails Rails	Version 4.0.1 rc2
Rubyonrails Rails	Version 4.0.1 rc3
Rubyonrails Rails	Version 4.0.1 rc4
Rubyonrails Rails	Version 4.0.2
Rubyonrails Rails	Version 4.0.3
Rubyonrails Rails	Version 4.0.4
Rubyonrails Rails	Version 4.0.5
Rubyonrails Rails	Version 4.0.6
Rubyonrails Rails	Version 4.0.6 rc1
Rubyonrails Rails	Version 4.0.6 rc2
Rubyonrails Rails	Version 4.0.6 rc3
Rubyonrails Rails	Version 4.0.7
Rubyonrails Rails	Version 4.0.8
Rubyonrails Rails	Version 4.0.9
Rubyonrails Rails	Version 4.1.0
Rubyonrails Rails	Version 4.1.0 beta1
Rubyonrails Rails	Version 4.1.1
Rubyonrails Rails	Version 4.1.2
Rubyonrails Rails	Version 4.1.2 rc1
Rubyonrails Rails	Version 4.1.2 rc2
Rubyonrails Rails	Version 4.1.2 rc3
Rubyonrails Rails	Version 4.1.3
Rubyonrails Rails	Version 4.1.4
Rubyonrails Rails	Version 4.1.5
Rubyonrails Rails	Version 4.1.6 rc1
Rubyonrails Rails	Version 4.1.7
Rubyonrails Rails	Version 4.1.8
Rubyonrails Rails	Version 4.2.0 beta1
Rubyonrails Rails	Version 4.2.1
Rubyonrails Rails	Version 4.2.2
Rubyonrails Rails	Version 4.2.3
Rubyonrails Rails	Version 4.2.4
Rubyonrails Rails	Version 4.2.5
Rubyonrails Rails	Version 5.0.0 beta1