CVE-2014-3916: Rubyonrails Rails

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string.

Affected products

• Rubyonrails Rails: version 1.9.3 only; version 2.0.0 only; version 2.1.0 only

Published 2014-11-16. Last modified 2026-06-17.