CVE-2012-5371: Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restrict...

Security readout for executives and security teams

This is a denial-of-service issue in old CRuby runtimes. Specially crafted input can make Ruby spend excessive CPU time handling hash tables, potentially slowing or stopping affected applications. It matters mainly for legacy systems still running Ruby 1.9 before 1.9.3-p327 or Ruby 2.0 before r37575. Exposure is most likely in legacy Ruby applications that accept attacker-controlled input and process it into Ruby hash tables. The source bundle identifies Ruby 1.9 before 1.9.3-p327 and Ruby 2.0 before r37575. Prioritize if any business-critical or internet-facing service still runs the affected Ruby versions. For modern supported Ruby stacks, urgency is lower, but legacy inventory should be verified because exploitation causes availability impact rather than data theft. Mitigation focus: Upgrade CRuby 1.9 to 1.9.3-p327 or later vendor-supported packages.; For Ruby 2.0 development builds, verify inclusion of r37575 or later fixes.; Apply distribution security updates from vendors such as Ubuntu or Red Hat where applicable..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.