{"action":"Upgrade activesupport to 3.2.22 or later.","affected":[{"fixed":"4.1.11","introduced":"4.0.0.beta1"},{"fixed":"4.2.2","introduced":"4.2.0.beta1"},{"fixed":"3.2.22","introduced":"0"}],"component":"activesupport","cve_ids":["CVE-2015-3227"],"ecosystem":"RubyGems","epss":0.04261,"exploited":false,"fixed_versions":["4.1.11","4.2.2","3.2.22"],"ghsa_id":"GHSA-j96r-xvjq-r9pg","id":"tcs_01M5KEKVR4RBGJ79N7ZEFW55ZA","modified_at":"2025-03-31T18:44:01.925647Z","published_at":"2017-10-24T18:33:36Z","references":["https://osv.dev/vulnerability/GHSA-j96r-xvjq-r9pg","https://nvd.nist.gov/vuln/detail/CVE-2015-3227","https://github.com/rails/rails/commit/12f763ce1131d29d24bd0d8f868e2697a139aea3","https://github.com/rails/rails/commit/153cc843ad95930b00b0ca91d30b599b7dec9680","https://github.com/rails/rails/commit/78b29e08c700d889837af6c51c7debd3864abc3d","https://github.com/rails/rails","https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J","https://web.archive.org/web/20200228041703/http://www.securityfocus.com/bid/75234","https://web.archive.org/web/20200517005133/http://www.securitytracker.com/id/1033755","http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html","http://openwall.com/lists/oss-security/2015/06/16/16","http://www.debian.org/security/2016/dsa-3464"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-j96r-xvjq-r9pg","url":"https://osv.dev/vulnerability/GHSA-j96r-xvjq-r9pg"}],"summary":"activesupport vulnerable to Denial of Service via large XML document depth"}