actionpack is vulnerable to denial of service because of a wildcard controller route (GHSA-9h6g-gp95-x3q5)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-7581
Severity: HIGH · CWE: 

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Affected packages:
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.5.1
database_specific: last_known_affected_version_range: <= 4.2.5.0