CVE-2015-3227
activesupport vulnerable to Denial of Service via large XML document depth
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Exploit likelihood
What each source reports
NVD Score used
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
CVE-2015-3227- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
CVE-2015-3227- Updated
- 2026-11-02
EUVDEUVD-2017-0259 No score
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
EUVD-2017-0259- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j96r-xvjq-r9pg No score
activesupport vulnerable to Denial of Service via large XML document depth
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
GHSA-j96r-xvjq-r9pg- Updated
- 2026-11-02
OSV No score
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
CVE-2015-3227- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3227 No score
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
DEBIAN-CVE-2015-3227- Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-j96r-xvjq-r9pg No score
activesupport vulnerable to Denial of Service via large XML document depth
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
GHSA-j96r-xvjq-r9pg- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10574-1 No score
ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10574-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0047-1 No score
Security update for rubygem-activesupport-3_2
rubygem-activesupport-3_2 was updated to fix one security issue.
This security issue was fixed:
- CVE-2015-3227: Possible Denial of Service attack in Active Support (bsc#934800).
- Record
SUSE-SU-2016:0047-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0082-1 No score
Security update for rubygem-activesupport-4_1
This update fixes the following security issues:
-
CVE-2015-3227: Possible Denial of Service attack in Active Support (bnc#934800)
-
CVE-2015-3226: XSS Vulnerability in ActiveSupport::JSON (bnc#934799)
- Record
SUSE-SU-2016:0082-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3227 No score
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- Record
UBUNTU-CVE-2015-3227- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activesupportRubyGems |
4.0.0.beta1 up to 4.1.11 | 4.1.11 |
activesupportRubyGems |
4.2.0.beta1 up to 4.2.2 | 4.2.2 |
activesupportRubyGems |
before 3.2.22 | 3.2.22 |
railsDebian:12 |
before 2:4.2.4-2 | 2:4.2.4-2 |
railsDebian:13 |
before 2:4.2.4-2 | 2:4.2.4-2 |
railsDebian:14 |
before 2:4.2.4-2 | 2:4.2.4-2 |
ruby-activesupport-3.2Debian:7 |
before 3.2.6-6+deb7u2, plus listed versions 3.2.6-63.2.6-6+deb7u1 |
3.2.6-6+deb7u2 |
railsDebian:8 From an advisory covering 8 CVEs |
before 2:4.1.8-1+deb8u1, plus listed versions 2:4.1.8-1 |
2:4.1.8-1+deb8u1 |
activesupportRubyGems |
4.0.0.beta1 up to 4.1.11, plus listed versions 4.0.04.0.0.rc14.0.0.rc24.0.14.0.1.rc1 Show 45 moreShow less4.0.1.rc24.0.1.rc34.0.1.rc44.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.124.0.134.0.13.rc14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.94.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.7 |
4.1.11 |
activesupportRubyGems |
4.2.0.beta1 up to 4.2.2, plus listed versions 4.2.04.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc1 Show 7 moreShow less4.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc4 |
4.2.2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
activesupportRubyGems |
before 3.2.22, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.1.01.1.11.2.11.2.21.2.31.2.41.2.51.3.01.3.11.4.01.4.11.4.21.4.31.4.42.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.172.3.182.3.22.3.32.3.42.3.52.3.62.3.6.pre2.3.72.3.82.3.8.pre12.3.92.3.9.pre3.0.03.0.0.beta |
3.2.22 |
rubygem-activesupport-3_2SUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 3.2.12-0.14.3 | 3.2.12-0.14.3 |
rubygem-activesupport-3_2SUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 3.2.12-0.14.3 | 3.2.12-0.14.3 |
rubygem-activesupport-3_2SUSE:Lifecycle Management Server 1.3 |
before 3.2.12-0.14.3 | 3.2.12-0.14.3 |
rubygem-activesupport-3_2SUSE:Studio Onsite 1.3 |
before 3.2.12-0.14.3 | 3.2.12-0.14.3 |
rubygem-activesupport-3_2SUSE:WebYast 1.3 |
before 3.2.12-0.14.3 | 3.2.12-0.14.3 |
rubygem-activesupport-4_1SUSE:OpenStack Cloud 5 From an advisory covering 2 CVEs |
before 4.1.9-9.2 | 4.1.9-9.2 |
rubygem-activesupport-4_2openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 5.0.0.1-1.1 | 5.0.0.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3227 is a medium vulnerability (CVSS 5.0) in Rubyonrails Rails, published July 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.23%, the 91st percentile. Fixed in activesupport 4.1.11.
References
securitytracker.com/id/1033755
securityfocus.com/bid/75234
groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J
lists.opensuse.org/opensuse-updates/2015-07/msg00050.html
debian.org/security/2016/dsa-3464
openwall.com/lists/oss-security/2015/06/16/16
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-3227
web.archive.org/web/20200228041703/http://www.securityfocus.com/bid/75234
github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3
security-tracker.debian.org/tracker/CVE-2015-3227
suse.com/support/update/announcement/2016/suse-su-20160047-1
bugzilla.suse.com/934800
ubuntu.com/security/CVE-2015-3227
cve.org/CVERecord?id=CVE-2015-3227
Left out here: 115 versions. The JSON record has them.