CVE-2019-16201

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-162026.5MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __cCVE-2019-162037.5Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are giveCVE-2019-162047.5Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keCVE-2019-162058.8A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability iCVE-2019-162065.5The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' loggCVE-2019-162077.8Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end databaseCVE-2019-162087.5Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may CVE-2019-162097.4A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-miCVE-2019-16217.5A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attCVE-2019-162105.5Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.CVE-2019-162119.8Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.CVE-2019-162128.8A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulne
CVE-2019-16201: High severity, CVSS 7.5 | Vulnix