Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

encoded_id-rails

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5RubyGemsPublished

    encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

    CVE-2024-0241 · GHSA-3px7-jm2p-6h2c

    Affected
    • RubyGems encoded_id-rails < 1.0.0.beta2
    Fixed in
    1.0.0.beta2· Vendor fix available
    Issue
    Impact The length of URIs and the various parts (eg path segments, query parameters) is usually limited by the webserver processing the incoming request. In the case of Puma the defaults are : - path segment length: 8192 - Max URI length: 1024 12 - Max query length: 1024 10 See https://github.com/puma/puma/blob/master/docs/compileoptions.md If too long Puma raises: Puma caught this error: HTTP element REQUESTPATH is longer than the (8192) allowed length (was 12503) (Puma::HttpParserError) However due to the performance of hashids extremely long encoded IDs will consume a large amount of CPU and allocate a huge number of intermediate objects. For example: This causes the application to spend a huge amount of time decoding the ID and the allocation of 200MB of objects. Patches Upgrade to 1.0.0.beta2 This introduces a new option to limit the length of IDs that can be decoded. A future release will also improve the performance and hugely reduce allocations in the underlying hashids…

    Recommended action: Upgrade to 1.0.0.beta2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →