Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for…
Priority LOW 29CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Why it matters now
EPSS 0.03871 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rack (RubyGems): 1.1.3, 1.2.5, 1.3.6org.jruby:jruby-parent (Maven): 1.6.5.1Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rack (RubyGems) | before 1.1.3 | 1.1.3 | Patch available | GHSA-v6j3-7jrw-hq2p |
| — | rack (RubyGems) | 1.2.0 to before 1.2.5 | 1.2.5 | Patch available | GHSA-v6j3-7jrw-hq2p |
| — | rack (RubyGems) | 1.3.0 to before 1.3.6 | 1.3.6 | Patch available | GHSA-v6j3-7jrw-hq2p |
| — | org.jruby:jruby-parent (Maven) | before 1.6.5.1 | 1.6.5.1 | Patch available | GHSA-v6j3-7jrw-hq2p |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rack (RubyGems) Vendor— Affected before 1.1.3 Fixed in 1.1.3 Patch available GHSA-v6j3-7jrw-hq2p
- rack (RubyGems) Vendor— Affected 1.2.0 to before 1.2.5 Fixed in 1.2.5 Patch available GHSA-v6j3-7jrw-hq2p
- rack (RubyGems) Vendor— Affected 1.3.0 to before 1.3.6 Fixed in 1.3.6 Patch available GHSA-v6j3-7jrw-hq2p
- org.jruby:jruby-parent (Maven) Vendor— Affected before 1.6.5.1 Fixed in 1.6.5.1 Patch available GHSA-v6j3-7jrw-hq2p
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:* | up to 1.1.0 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.2.3:*:*:*:*:*:*:* | 1.2.3 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.2.4:*:*:*:*:*:*:* | 1.2.4 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.3.1:*:*:*:*:*:*:* | 1.3.1 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.3.2:*:*:*:*:*:*:* | 1.3.2 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.3.3:*:*:*:*:*:*:* | 1.3.3 | Vulnerable | Rack Project |
- cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Rack Project
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rack_project:rack:1.3.4:*:*:*:*:*:*:* | 1.3.4 | Vulnerable | Rack Project |
| cpe:2.3:a:rack_project:rack:1.3.5:*:*:*:*:*:*:* | 1.3.5 | Vulnerable | Rack Project |
- cpe:2.3:a:rack_project:rack:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·Rack Project
- cpe:2.3:a:rack_project:rack:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·Rack Project
Remediation
- Fix · GHSA-v6j3-7jrw-hq2p rack (RubyGems) Fixed in 1.1.3 Advisory →
- Fix · GHSA-v6j3-7jrw-hq2p rack (RubyGems) Fixed in 1.2.5 Advisory →
- Fix · GHSA-v6j3-7jrw-hq2p rack (RubyGems) Fixed in 1.3.6 Advisory →
- Fix · GHSA-v6j3-7jrw-hq2p org.jruby:jruby-parent (Maven) Fixed in 1.6.5.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2011-5036
- 2026-10-03 Alias added: GHSA-v6j3-7jrw-hq2p
- 2026-10-14 EPSS moved to the 90th–95th percentile
References
Other 6
- http://www.nruns.com/_downloads/advisory28122011.pdf
- 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table
- http://www.ocert.org/advisories/ocert-2011-003.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2011-5036.yml
- https://web.archive.org/web/20120201040317/http://jruby.org/2011/12/27/jruby-1-6-5-1
- https://web.archive.org/web/20130213132312/http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
More Rack Project Rack vulnerabilities
- TI-2022-12397 A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which… CVSS 3.1CRITICAL 10.0
- TI-2022-12396 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
- TI-2020-06579 Path traversal in https://github.com/rack/rack CVSS 3.1HIGH 8.6
- TI-2020-06602 Improper input validation in https://github.com/rack/rack CVSS 3.1HIGH 7.5
- TI-2018-11812 Uncontrolled resource consumption in Rack CVSS 3.0HIGH 7.5
- TI-2015-02854 lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2011-5036 · CVE Program
- CVE-2011-5036 · NVD
- FIRST EPSS
- GHSA-v6j3-7jrw-hq2p · GitHub Advisory Database · CC BY 4.0
- CVE-2011-5036 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences