CVE-2024-35221
mediumpriority · track · 0EPSS 0.005 · 42 %ileEURUEPSS · scored 2026-10-27
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-35221/cnnvd
- https://en.wikipedia.org/wiki/Billion_laughs_attackcnnvd
- https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28cnnvd
- https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2cnnvd
- https://vigilance.fr/vulnerability/Rubygems-denial-of-service-via-Manifest-SafeYAML-load-48020cnnvd
- https://en.wikipedia.org/wiki/Billion_laughs_attackenisa_euvd
- https://github.com/ruby/ruby/blob/7cf74a2ff28b1b4c26e367d0d67521f7e1fed239/lib/rubygems/safe_yaml.rb#L28enisa_euvd
- https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4vc5-whwr-7hh2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan