Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

unpoly-rails

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9RubyGemsPublished

    unpoly-rails Denial of Service vulnerability

    CVE-2023-28846 · GHSA-m875-3xf6-mf78

    Affected
    • RubyGems unpoly-rails < 2.7.2.2
    Fixed in
    2.7.2.2· Vendor fix available
    Issue
    There is a possible Denial of Service (DoS) vulnerability in the unpoly-rails gem that implements the Unpoly server protocol for Rails applications. Impact This issues affects Rails applications that operate as an upstream of a load balancer's that uses passive health checks. The unpoly-rails gem echoes the request URL as an X-Up-Location response header. By making a request with exceedingly long URLs (paths or query string), an attacker can cause unpoly-rails to write a exceedingly large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group. This causes that application instance to become unavailable until a configured timeout is reached or until an active healthcheck succeeds. Patches The fixed release 2.7.2.2+ is available via RubyGems and GitHub. Workarounds If you cannot upgrade to a fixed release, several workarounds are…

    Recommended action: Upgrade to 2.7.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →