Denial of Service Vulnerability in WEBrick's Digest Authentication for Ruby

CVE-2019-16201

What is CVE-2019-16201?

The WEBrick::HTTPAuth::DigestAuth component in Ruby versions 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 is susceptible to a Denial of Service attack due to a vulnerability in its regular expression handling. Affected systems may experience significant performance degradation when exposed to malicious requests, particularly when the server is accessible on the Internet or an untrusted network. Operators should ensure they apply recommended security updates to mitigate this risk.

References