Vulnerability advisory

CVE-2016-0751

Published Feb 16, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
375d9a0a7fb329b0fbbd75a13e93e53a00520587 through 099ddfdefd44fda11d0f6a72f934f8a0ee83141b	No fix listed
Also listed as affected (60) `4.0.0-NA` `4.0.0-beta` `4.0.0-rc1` `4.0.0-rc2` `4.0.1-NA` `4.0.1-rc1` `4.0.1-rc2` `4.0.1-rc3` `4.0.1-rc4` `4.0.10` `4.0.10-rc1` `4.0.2` `4.0.3` `4.0.4` `4.0.5` `4.0.6` `4.0.6-rc1` `4.0.6-rc2` `4.0.6-rc3` `4.0.7` `4.0.8` `4.0.9` `4.1.0-NA` `4.1.0-beta1` `4.1.1` `4.1.10` `4.1.12` `4.1.13` `4.1.2` `4.1.2-rc1` `4.1.2-rc2` `4.1.2-rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6-rc1` `4.1.7` `4.1.8` `4.1.9` `4.2.0-beta1` `4.2.0-beta2` `4.2.0-beta3` `4.2.0-beta4` `4.2.0-rc1` `4.2.0-rc2` `4.2.0-rc3` `4.2.1` `4.2.1-rc1` `4.2.1-rc2` `4.2.1-rc3` `4.2.1-rc4` `4.2.2` `4.2.3` `4.2.3-rc1` `4.2.4` `4.2.4-rc1` `4.2.5` `4.2.5-rc1` `4.2.5-rc2` `5.0.0-beta1`

Description

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

CVE-2016-0751

Affected versions

Repository

Description

References