🎯 New Report #3079931: Memory leak in gem decode logic can allow attacker to take down Rubygems.org application
🔺Severity: Medium
👽 Reporter: mclaren650sspider
⭐️ Reputation: 6390
🛠 State: resolved
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2025-04-06
⏰ Disclosed: 2026-04-09 11:46:38
📝 Summary: A memory leak vulnerability was discovered in the gem decode logic of the Rubygems.org application. The vulnerability allowed an attacker with a valid API key to set arbitrary instance variables during the decoding of gem metadata, which would cause the server to exhaust its memory. The issue was addressed by restricting the instance variables that can be set during metadata decoding.
📂 Report JSON File: 3079931
@hackeronereports