CVE-2008-2376: Ruby-Lang Ruby

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.

Affected products

Published 2008-07-09. Last modified 2026-06-16.