CVE-2008-3656: Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP...

Security readout for executives and security teams

This is a denial-of-service issue in old Ruby WEBrick. A specially crafted HTTP request can make Ruby spend excessive CPU while parsing a header, potentially slowing or taking down an exposed service. It affects legacy Ruby versions listed in the CVE, not modern supported Ruby by default. Exposure is most likely in legacy applications running WEBrick on Ruby 1.8.5 or earlier, 1.8.6 through p286, 1.8.7 through p71, or Ruby 1.9 through r18423, especially if WEBrick is reachable over a network. Prioritize remediation where old Ruby WEBrick is exposed to untrusted traffic. This is mainly an availability risk, but CPU exhaustion can still create business disruption if the service supports production workflows. Mitigation focus: Upgrade Ruby/WEBrick using the applicable vendor advisory or package update.; Move affected Ruby runtimes to supported versions outside the listed vulnerable ranges.; Restrict network access to WEBrick services that cannot be upgraded immediately..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.