Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Remediation
References
Related Vulnerabilities
MySQL CVE-2024-21166 Vulnerability (CVE-2024-21166)
WordPress Plugin YITH WooCommerce Product Add-Ons Multiple Vulnerabilities (2.0.7)
WordPress Plugin Backup and Restore WordPress-WPBackItUp Multiple Vulnerabilities (1.9)
WordPress Plugin Nofollow for external link Multiple Unspecified Vulnerabilities (1.1.2)