Every CVE Search/ Get API key

CVE-2014-6438

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to...

7.5 HighFix available

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.13%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Record
CVE-2014-6438
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Record
CVE-2014-6438
Updated
2026-11-02
EUVDEUVD-2014-6318 No score

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Record
EUVD-2014-6318
Updated
2026-11-03
GitHub AdvisoriesGHSA-2j3h-55rq-rj48 7.5

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to...

The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.

Record
GHSA-2j3h-55rq-rj48
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7305 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7305
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:7307 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7307
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:8838 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:8838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ruby1.9.1
Debian:6.0
 before 1.9.2.0-2+deb6u6, plus listed versions
1.9.2.0-21.9.2.0-2+armhf
1.9.2.0-2+deb6u6
ruby3.3
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.3-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.3-default-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.3-devel
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.3-doc
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.3-libs
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.3.10-23.1.hum1
0:3.3.10-23.1.hum1
ruby3.4
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
ruby3.4-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
ruby3.4-default-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
ruby3.4-devel
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
ruby3.4-doc
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
ruby3.4-libs
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:3.4.8-31.1.hum1
0:3.4.8-31.1.hum1
ruby4.0
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1
ruby4.0-devel
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1
ruby4.0-doc
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1
ruby4.0-libs
Red Hat:hummingbird:1
From an advisory covering 36 CVEs
 before 0:4.0.0-33.3.hum1
0:4.0.0-33.3.hum1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-6438 is a high vulnerability (CVSS 7.5) in Ruby-lang Ruby, published July 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.13%, the 90th percentile. Fixed in ruby1.9.1 1.9.2.0-2+deb6u6.

References

Show 161 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open