CVE-2008-3905: Ruby-Lang Ruby

Medium severity, CVSS 5.8. EPSS: 2.4% chance of exploitation in the next 30 days.

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

Affected products

• Ruby-Lang Ruby: up to and including 1.8.5; up to and including 1.8.6; up to and including 1.8.7; up to and including 1.9; version 1.6 only; version 1.6.8 only; …

Published 2008-09-04. Last modified 2026-06-16.