CVE-2009-1904: The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers t...

Security readout for executives and security teams

CVE-2009-1904 is a denial-of-service flaw in Ruby's BigDecimal library. Older Ruby 1.8.6 and 1.8.7 releases can crash when handling a specially large numeric string. The main business risk is outage in legacy Ruby services that parse untrusted numbers. Exposure is most likely in legacy Ruby 1.8 applications or OS packages still present on old servers, appliances, or unsupported Rails stacks that process user-controlled numeric input through BigDecimal-related paths. Prioritize remediation where Ruby 1.8 remains internet-facing or processes customer-controlled input. For modern environments without Ruby 1.8, urgency is low, but legacy discovery matters because unsupported runtimes often carry broader accumulated risk. Mitigation focus: Upgrade Ruby 1.8.6 to p369 or later if that branch is still in use.; Upgrade Ruby 1.8.7 to p173 or later if that branch is still in use.; Prefer migration to a supported Ruby release where operationally feasible..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.