CVE-2006-4112

no score yetEPSS 3.1%

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.

EPSS: 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
Published: 2006-08-14
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

rubyonrails:rails

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9wrq-xvmp-xjc8	RubyGems	rails	>=1.1.0 <1.1.6	1.1.6

References

http://secunia.com/advisories/21424
http://secunia.com/advisories/21466
http://secunia.com/advisories/21749
http://securitytracker.com/id?1016673
http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure

Check your stack JSON