{"id":"CVE-2024-35221","aliases":["EUVD-2024-35247","OESA-2024-1780","OESA-2024-1938","SUSE-SU-2025:02814-1","SUSE-SU-2025:02814-2","SUSE-SU-2025:4264-1"],"status":"published","title":"Denial of service when publishing a package on rubygems.org","description":"Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00494,"percentile":0.42911,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-05-29T20:18:06Z","modified":"2026-08-18T01:18:32Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","fixed_in":["2.5.8-125.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"ruby","fixed_in":["3.0.3-135.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"ruby","fixed_in":["3.0.3-135.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ruby","fixed_in":["3.2.2-142.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server LTS 4.3","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"ruby2.5","fixed_in":["2.5.9-150000.4.49.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-125.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-135.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-135.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-142.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150700.24.3.1"}]}],"bundled":8}],"products":[{"vendor":"rubygems","product":"rubygems.org"}],"references":[{"url":"https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://en.wikipedia.org/wiki/Billion_laughs_attack","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35221","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1938","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502814-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225905","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35221","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502814-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254264-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230930","tags":["report"]},{"url":"https://bugzilla.suse.com/1232440","tags":["report"]},{"url":"https://bugzilla.suse.com/1235773","tags":["report"]},{"url":"https://bugzilla.suse.com/1237804","tags":["report"]},{"url":"https://bugzilla.suse.com/1237805","tags":["report"]},{"url":"https://bugzilla.suse.com/1237806","tags":["report"]},{"url":"https://bugzilla.suse.com/1245254","tags":["report"]},{"url":"https://bugzilla.suse.com/1246430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6442","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-35221","title":"Denial of service when publishing a package on rubygems.org","description":"Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.","status":"published","published":"2024-05-29T20:18:06.763Z","modified":"2024-08-02T03:07:46.784Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-35247","description":"Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.","status":"published","published":"2024-05-29T20:18:06Z","modified":"2024-08-02T03:07:46Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:20.360548Z"}],"nvd":[{"id":"CVE-2024-35221","description":"Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.","status":"published","published":"2024-05-29T21:15:49.017Z","modified":"2026-06-17T07:34:34.257Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"OESA-2024-1780","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\r\n\r\nSecurity Fix(es):\r\n\r\nRubygems.org is the Ruby community\u0026apos;s gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.(CVE-2024-35221)","status":"published","published":"2024-06-28T11:07:14Z","modified":"2026-08-18T01:18:27.595914529Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1938","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\r\n\r\nSecurity Fix(es):\r\n\r\nRubygems.org is the Ruby community\u0026apos;s gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.(CVE-2024-35221)","status":"published","published":"2024-08-02T11:07:24Z","modified":"2026-08-18T01:18:32.53200836Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"SUSE-SU-2025:02814-1","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2024-35221: Fixed remote denial of service via YAML manifest (bsc#1225905)\n","status":"published","published":"2025-08-15T12:53:23Z","modified":"2026-03-23T04:47:52.803566Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02814-2","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2024-35221: Fixed remote denial of service via YAML manifest (bsc#1225905)\n","status":"published","published":"2025-09-04T09:16:41Z","modified":"2026-03-23T04:47:52.838896Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:4264-1","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2024-35221: Fixed remote DoS via YAML manifest (bsc#1225905)\n- CVE-2024-47220: Fixed HTTP request smuggling in WEBrick (bsc#1230930)\n- CVE-2024-49761: Fixed ReDOS vulnerability by updating REXML to 3.3.9 (bsc#1232440)\n- CVE-2025-24294: Fixed denial of service (DoS) caused by an insufficient check on the length \n  of a decompressed domain name within a DNS packet in resolv gem (bsc#1246430)\n- CVE-2025-27219: Fixed denial of service in CGI::Cookie.parse (bsc#1237804)\n- CVE-2025-27220: Fixed ReDoS in CGI::Util#escapeElement (bsc#1237806)\n- CVE-2025-27221: Fixed userinfo leakage in URI#join, URI#merge and URI#+ (bsc#1237805)\n- CVE-2025-6442: Fixed ruby WEBrick read_header HTTP request smuggling vulnerability (bsc#1245254)\n","status":"published","published":"2025-11-26T15:52:44Z","modified":"2026-03-23T04:51:29.7996Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}