CVE-2015-3227
No CVSS score yet. EPSS 4.3% chance of exploitation in the next 30 days. Fixed in activesupport 3.2.22, 4.1.11, 4.2.2.
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
- EPSS
- 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- opensuse:opensuse
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j96r-xvjq-r9pg | RubyGems | activesupport | >=4.0.0.beta1 <4.1.11 | 4.1.11 |
| GHSA-j96r-xvjq-r9pg | RubyGems | activesupport | >=4.2.0.beta1 <4.2.2 | 4.2.2 |
| GHSA-j96r-xvjq-r9pg | RubyGems | activesupport | <3.2.22 | 3.2.22 |