CVE-2006-6303

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-06 · updated 2026-06-16
Weakness: CWE-399

Description

The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.

Affected products

Yukihiro Matsumoto Ruby: 1.8, 1.8.1, 1.8.2, 1.8.2_pre1, 1.8.2_pre2, 1.8.3 (+2)

References

http://bugs.gentoo.org/show_bug.cgi?id=157048
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218287
http://docs.info.apple.com/article.html?artnum=305530
http://jvn.jp/jp/JVN%2384798830/index.html
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html
http://secunia.com/advisories/23165
http://secunia.com/advisories/23268
http://secunia.com/advisories/23454
http://secunia.com/advisories/25402
http://secunia.com/advisories/27576
http://secunia.com/advisories/31090
http://security.gentoo.org/glsa/glsa-200612-21.xml

Get alerted when CVE-2006-6303 or the next vulnerability affects your stack