CVE-2013-4287

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

• CWE-310

• http://blog.rubygems.org/2013/09/09/CVE-2013-4287.htmlPatch, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1427.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1441.html
• http://rhn.redhat.com/errata/RHSA-2013-1523.html
• http://rhn.redhat.com/errata/RHSA-2013-1852.html
• http://rhn.redhat.com/errata/RHSA-2014-0207.html
• http://secunia.com/advisories/55381
• http://www.openwall.com/lists/oss-security/2013/09/10/1Patch
• https://puppet.com/security/cve/cve-2013-4287
• http://blog.rubygems.org/2013/09/09/CVE-2013-4287.htmlPatch, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1427.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1441.html
• http://rhn.redhat.com/errata/RHSA-2013-1523.html
• http://rhn.redhat.com/errata/RHSA-2013-1852.html
• http://rhn.redhat.com/errata/RHSA-2014-0207.html
• http://secunia.com/advisories/55381
• http://www.openwall.com/lists/oss-security/2013/09/10/1Patch
• https://puppet.com/security/cve/cve-2013-4287

Published

Oct 17, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4281In Red Hat Openshift 1, weak default permissions are applied…5.5
• CVE-2013-4282Stack-based buffer overflow in the reds_handle_ticket functi…
• CVE-2013-4283ns-slapd in 389 Directory Server before 1.3.0.8 allows remot…
• CVE-2013-4284Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote …
• CVE-2013-4285A certain Gentoo patch for the PAM S/Key module does not pro…
• CVE-2013-4286Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x befo…
• CVE-2013-4288Race condition in PolicyKit (aka polkit) allows local users …
• CVE-2013-4289Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPE…
• CVE-2013-4290Stack-based buffer overflow in OpenJPEG before 1.5.2 allows …
• CVE-2013-4291The virSecurityManagerSetProcessLabel function in libvirt 0.…
• CVE-2013-4292libvirt 1.1.0 and 1.1.1 allows local users to cause a denial…
• CVE-2013-4293The server in Red Hat JBoss Operations Network (JON) 3.1.2 l…