Vulnerability record · CVE-2009-4124 · published 11 December 2009

CVE-2009-4124: Ruby-lang ruby memory buffer overflow vulnerability

Ruby Lang · Ruby

Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information.

10.0 CVSS 2.0 High EPSS 3.9% · top 10.2% CWE-119 · Memory buffer overflow

10.0CVSS 2.0 base score

3.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ruby Ruby Lang

References

Link	Tags
http://secunia.com/advisories/37660	Vendor Advisory
http://www.osvdb.org/60880
http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/	PatchVendor Advisory
http://www.securityfocus.com/bid/37278
http://www.vupen.com/english/advisories/2009/3471	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54674
http://secunia.com/advisories/37660	Vendor Advisory
http://www.osvdb.org/60880
http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/	PatchVendor Advisory
http://www.securityfocus.com/bid/37278
http://www.vupen.com/english/advisories/2009/3471	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54674

Track CVE-2009-4124 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-2662Ruby-lang ruby vulnerabilityMultiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 befor…EPSS 4.3%24 Jun 2008 10.0CVE-2008-2663Ruby-lang ruby integer overflow vulnerabilityMultiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before…EPSS 4.5%24 Jun 2008 9.8CVE-2016-2338Ruby-lang ruby out-of-bounds write vulnerabilityAn exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function he…EPSS 4.7%29 Sep 2022 9.8CVE-2022-28738Ruby-lang ruby double free vulnerabilityA double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untruste…EPSS 2.9%9 May 2022 9.8CVE-2011-4121Ruby-lang ruby inadequate encryption strength vulnerabilityThe OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private…EPSS 2.5%26 Nov 2019 9.8CVE-2018-16395Ruby-lang openssl vulnerabilityAn issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When tw…EPSS 11%16 Nov 2018 9.8CVE-2017-17790Ruby-lang ruby injection vulnerabilityThe lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by…EPSS 5.9%20 Dec 2017 9.8CVE-2017-14064Ruby-lang ruby memory buffer overflow vulnerabilityRuby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using st…EPSS 9.4%31 Aug 2017

Source: NIST National Vulnerability Database (record CVE-2009-4124), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.