CVE-2008-3443

CVE-2008-3443 describes a denial-of-service vulnerability in the regular expression engine of Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423. An unauthenticated remote attacker can trigger an infinite loop and crash by sending multiple long requests to a Ruby socket, often due to memory allocation failure, as demonstrated against Webrick. This vulnerability has a CVSS score of 5.0, indicating a medium severity with low attack complexity and potential for partial availability impact. While there is an ExploitDB entry for a related memory leak, there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.