{"id":"CVE-2015-3227","aliases":["DEBIAN-CVE-2015-3227","DLA-603-1","DSA-3464-1","EUVD-2017-0259","GHSA-j96r-xvjq-r9pg","SUSE-SU-2016:0047-1","SUSE-SU-2016:0082-1","UBUNTU-CVE-2015-3227","openSUSE-SU-2024:10574-1"],"status":"published","title":"activesupport vulnerable to Denial of Service via large XML document depth","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0423,"percentile":0.91077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-07-26T22:00:00Z","modified":"2026-09-09T06:47:17Z","fixes":[{"ecosystem":"RubyGems","package":"activesupport","fixed_in":["4.1.11","4.2.2","3.2.22"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ruby-activesupport-3.2","fixed_in":["3.2.6-6+deb7u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"rubygem-activesupport-3_2","fixed_in":["3.2.12-0.14.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"rubygem-activesupport-3_2","fixed_in":["3.2.12-0.14.3"],"sources":["osv"]},{"ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-activesupport-3_2","fixed_in":["3.2.12-0.14.3"],"sources":["osv"]},{"ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-activesupport-3_2","fixed_in":["3.2.12-0.14.3"],"sources":["osv"]},{"ecosystem":"SUSE:WebYast 1.3","package":"rubygem-activesupport-3_2","fixed_in":["3.2.12-0.14.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.beta1"},{"fixed":"4.1.11"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.beta1"},{"fixed":"4.2.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.22"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-activesupport-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-6+deb7u2"}]}],"versions":["3.2.6-6","3.2.6-6+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8-1+deb8u1"}]}],"versions":["2:4.1.8-1"],"bundled":8},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.beta1"},{"fixed":"4.1.11"}]}],"versions":["4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1"]},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.beta1"},{"fixed":"4.2.2"}]}],"versions":["4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4"]},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.22"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.6.pre","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.0.pre","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"rubygem-activesupport-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.14.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"rubygem-activesupport-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.14.3"}]}]},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-activesupport-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.14.3"}]}]},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-activesupport-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.14.3"}]}]},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-activesupport-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.14.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-activesupport-4_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"opensuse"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"http://www.securitytracker.com/id/1033755","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/75234","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3464","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://openwall.com/lists/oss-security/2015/06/16/16","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3227","tags":["advisory"]},{"url":"https://web.archive.org/web/20200228041703/http://www.securityfocus.com/bid/75234","tags":["web"]},{"url":"https://web.archive.org/web/20200517005133/http://www.securitytracker.com/id/1033755","tags":["web"]},{"url":"https://github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3","tags":["web"]},{"url":"https://github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680","tags":["web"]},{"url":"https://github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j96r-xvjq-r9pg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3227","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/934800","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3227","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160082-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/934799","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3226","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3227","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-3227","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T05:39:32.037Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2017-0259","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-j96r-xvjq-r9pg","title":"activesupport vulnerable to Denial of Service via large XML document depth","description":"The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2025-03-31T17:46:20Z","updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2015-3227","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2015-07-26T22:59:06.07Z","modified":"2026-06-17T00:25:34.7Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-3227","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2015-07-26T22:59:06Z","modified":"2026-04-10T03:45:14.958551Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3227","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2015-07-26T22:59:06.07Z","modified":"2026-09-09T06:47:17.753783229Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-603-1","title":"ruby-activesupport-3.2 - security update","status":"published","published":"2016-08-27T00:00:00Z","modified":"2026-03-09T02:11:39.980055Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3464-1","title":"rails - security update","status":"published","published":"2016-01-31T00:00:00Z","modified":"2026-03-09T01:23:14.489999Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"GHSA-j96r-xvjq-r9pg","title":"activesupport vulnerable to Denial of Service via large XML document depth","description":"The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2025-03-31T18:44:01.925647Z","updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"openSUSE-SU-2024:10574-1","title":"ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:33.541311Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:0047-1","title":"Security update for rubygem-activesupport-3_2","description":"rubygem-activesupport-3_2 was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2015-3227: Possible Denial of Service attack in Active Support (bsc#934800).\n  ","status":"published","published":"2016-01-07T12:54:36Z","modified":"2026-02-04T03:19:43.284273Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0082-1","title":"Security update for rubygem-activesupport-4_1","description":"\n\n  This update fixes the following security issues:\n\n - CVE-2015-3227: Possible Denial of Service\n  attack in Active Support (bnc#934800)\n\n - CVE-2015-3226:  XSS Vulnerability in\n  ActiveSupport::JSON (bnc#934799)\n\n","status":"published","published":"2016-01-12T10:24:18Z","modified":"2026-02-04T02:56:54.450131Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-3227","description":"The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.","status":"withdrawn","published":"2015-07-26T22:59:00Z","modified":"2025-07-16T08:11:29.732459Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}