CVE-2019-16201: High severity ruby-lang Ruby vulnerability
Last updated 11 July 2025
Other sources
Regular expression denial of service vulnerability of WEBrick’s Digest authentication module was found. An attacker can exploit this vulnerability to cause an effective denial of service against a WEBrick service.
Reference: https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
— Red Hat
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-16201?
CVE-2019-16201 is a vulnerability in Ruby's WEBrick::HTTPAuth::DigestAuth that can cause denial of service through looping/backtracking.
What is the severity of CVE-2019-16201?
CVE-2019-16201 is classified as a high severity vulnerability.
Which versions of Ruby are affected by CVE-2019-16201?
Versions 2.4.7 to 2.4.8, 2.5.x to 2.5.7, and 2.6.x to 2.6.5 of Ruby are affected by CVE-2019-16201.
How can I fix CVE-2019-16201?
To fix CVE-2019-16201, update Ruby to version 2.5.9 or later for Ruby 2.5.x, and version 2.6.6 or later for Ruby 2.6.x.
Where can I find more information about CVE-2019-16201?
You can find more information about CVE-2019-16201 on the CVE website, NVD, and the official Ruby website.