Every CVE Search/ Get API key

CVE-2016-2338

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function...

9.8 CriticalPublic exploitFix available

CVE-2016-2338 is a critical vulnerability (CVSS 9.8) in Ruby-lang Ruby, published February 14, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.74%, the 91st percentile. Fixed in ruby 2.0.0.648-39.el7_9.tuxcare.els9.

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.74%Up 3.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
CVE-2016-2338
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
CVE-2016-2338
Updated
2026-11-02
EUVDEUVD-2016-3422 No score

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
EUVD-2016-3422
Updated
2026-11-03
GitHub AdvisoriesGHSA-r46x-xjwr-8v2g 9.8

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function...

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
GHSA-r46x-xjwr-8v2g
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 9.8

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
CVE-2016-2338
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-2338 9.8

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

Record
UBUNTU-CVE-2016-2338
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1757699919 No score

ruby: Fix of CVE-2016-2338

  • CVE-2016-2338: fix heap overflow vulnerability in start_document function
Record
CLSA-2025-1757699919
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ruby
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
ruby-devel
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
ruby-doc
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
ruby-irb
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
ruby-libs
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
ruby-tcltk
TuxCare:CentOS:7
 before 2.0.0.648-39.el7_9.tuxcare.els9
2.0.0.648-39.el7_9.tuxcare.els9
rubygem-bigdecimal
TuxCare:CentOS:7
 before 1.2.0-39.el7_9.tuxcare.els9
1.2.0-39.el7_9.tuxcare.els9
rubygem-io-console
TuxCare:CentOS:7
 before 0.4.2-39.el7_9.tuxcare.els9
0.4.2-39.el7_9.tuxcare.els9
rubygem-json
TuxCare:CentOS:7
 before 1.7.7-39.el7_9.tuxcare.els9
1.7.7-39.el7_9.tuxcare.els9
rubygem-minitest
TuxCare:CentOS:7
 before 4.3.2-39.el7_9.tuxcare.els9
4.3.2-39.el7_9.tuxcare.els9
Show 6 moreShow less
Affected packages
PackageAffectedFixed
rubygem-psych
TuxCare:CentOS:7
 before 2.0.0-39.el7_9.tuxcare.els9
2.0.0-39.el7_9.tuxcare.els9
rubygem-rake
TuxCare:CentOS:7
 before 0.9.6-39.el7_9.tuxcare.els9
0.9.6-39.el7_9.tuxcare.els9
rubygem-rdoc
TuxCare:CentOS:7
 before 4.0.0-39.el7_9.tuxcare.els9
4.0.0-39.el7_9.tuxcare.els9
rubygems
TuxCare:CentOS:7
 before 2.0.14.1-39.el7_9.tuxcare.els9
2.0.14.1-39.el7_9.tuxcare.els9
rubygems-devel
TuxCare:CentOS:7
 before 2.0.14.1-39.el7_9.tuxcare.els9
2.0.14.1-39.el7_9.tuxcare.els9
ruby2.1
Debian:8
 before 2.1.5-2+deb8u9, plus listed versions
2.1.5-22.1.5-2+deb8u12.1.5-2+deb8u22.1.5-2+deb8u32.1.5-2+deb8u4
Show 4 moreShow less
2.1.5-2+deb8u52.1.5-2+deb8u62.1.5-2+deb8u72.1.5-2+deb8u8
2.1.5-2+deb8u9

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSpiralBL0CK/CVE-2016-2338-nday2022-12-19

History

History
WhenChangedSources
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open