CVE-2008-3656: Ruby WEBrick HTTP header parsing CPU exhaustion DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable availability impact with a high EPSS score and public exploit reference, though the software is legacy and no KEV listing exists.

What it is

WEBrick::HTTPUtils.split_header_value in Ruby's WEBrick HTTP server uses a backtracking regular expression, giving the code algorithmic complexity on crafted input. A remote attacker can send a specially crafted HTTP request that drives excessive CPU consumption in the server process. The flaw affects Ruby 1.8.5 and earlier, 1.8.6 up to p286, 1.8.7 up to p71, and 1.9 up to r18423.

Impact

An unauthenticated attacker can exhaust CPU on a WEBrick-based Ruby service, degrading or denying service to legitimate users. No confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via HTTP requests to a Ruby application served by WEBrick, per the AV:N vector. No authentication or user interaction is required (Au:N, AC:L).

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.70 (99th percentile), and one reference is tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade Ruby to a release after the affected ranges (1.8.5, 1.8.6-p286, 1.8.7-p71, 1.9 r18423) or apply the vendor patch.
• If WEBrick is not required, disable it and front the application with a maintained server or reverse proxy.
• Apply rate limiting and request-size limits at the proxy to blunt CPU-exhaustion floods.
• Monitor CPU usage on Ruby/WEBrick hosts and alert on sustained spikes tied to request volume.

Detection

• Alert on sustained high CPU in Ruby/WEBrick processes without a matching rise in legitimate traffic.
• Inspect HTTP request logs for unusually long or malformed header values hitting WEBrick endpoints.
• Correlate repeated requests from single sources with CPU spikes to identify DoS attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.