CVE-2008-3656
HighPublic exploitruby: WEBrick DoS vulnerability (CPU consumption)
Published Aug 8, 2008 · Updated Mar 9, 2026
Key Facts
Patch immediately- CVE-2008-3656 is a high-severity vulnerability (CVSS 7.8 v2) affecting Ruby (Ruby-Lang), ruby1.8 (debian), ruby1.9 (debian) and 10 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ruby 0:1.8.1-7.el4_7.1, Ruby 0:1.8.5-5.el5_2.5, Ruby 1.8.5-5.el5_2.5.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2008-3656 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.
Affected Products
58 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RubyRuby-Lang | 1.6.8, 1.8.0, 1.8.1, 1.8.1--9, 1.8.2, 1.8.2-preview2, 1.8.2-preview3, 1.8.2-preview4 | 1.8.5 |
| ruby1.8debian | See advisory | 1.8.5-4etch3 |
| ruby1.9debian | See advisory | 1.9.0+20060609-1etch3 |
| ruby-develoracle | See advisory | 1.8.5-5.el5_2.5 |
| ruby-docsoracle | See advisory | 1.8.5-5.el5_2.5 |
Patched Releases
Ruby
0:1.8.1-7.el4_7.1, 0:1.8.5-5.el5_2.5, 1.8.5-5.el5_2.5, 1.8.5
ruby-devel
1.8.5-5.el5_2.5
ruby-docs
1.8.5-5.el5_2.5
ruby-irb
1.8.5-5.el5_2.5
ruby-libs
1.8.5-5.el5_2.5
ruby-mode
1.8.5-5.el5_2.5
ruby-rdoc
1.8.5-5.el5_2.5
ruby-ri
1.8.5-5.el5_2.5
ruby-tcltk
1.8.5-5.el5_2.5
ruby1.8
1.8.5-4etch3
ruby1.9
1.9.0+20060609-1etch3
ruby3
3-main-3.3.10-23.1.hum1
ruby4
0-main-4.0.0-33.3.hum1
Timeline
Publicly disclosed
Aug 8, 2008
Last updated
Mar 9, 2026
Weakness Type
- CWE-399
References
- advisoryRHSA-2008:0897
- advisoryRHSA-2026:7305
- advisoryRHSA-2026:7307
- advisoryRHSA-2026:8838
- exploitExploitDB-32222
FAQ
Common Questions.
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumptio…
Affected: Ruby (Ruby-Lang) versions 1.6.8, 1.8.0, 1.8.1, 1.8.1--9, 1.8.2, 1.8.2-preview2, 1.8.2-preview3, 1.8.2-preview4; ruby1.8 (debian); ruby1.9 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Ruby 0:1.8.1-7.el4_7.1, Ruby 0:1.8.5-5.el5_2.5, Ruby 1.8.5-5.el5_2.5.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2008-3656 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo