CVE-2009-1904

Think of Ruby’s BigDecimal like a tool your app uses to work with very precise numbers. This bug can be triggered by a specially crafted “number as text” input that makes the number-processing engine choke and crash. If your app accepts requests from the network, a bad input can cause downtime.

This matters if you run an application using Ruby with BigDecimal (specifically Ruby 1.8.6 before p369 or Ruby 1.8.7 before p173). Because the problem is reachable over the network and does not require login, it’s most relevant for internet-facing apps or any service that accepts external input. Treat it as a risk when an attacker can reach the code path that processes BigDecimal from untrusted input.

This is urgent enough to prioritize because attackers can reach the vulnerable behavior over the network without needing an account, and the result is a crash (denial of service). There is also a known public exploit, which increases the chance of real-world abuse. Since this is marked AMBER, upgrade to the fixed Ruby patchlevel promptly and verify exposure in your running environment.

Confirm exposure

• Determine the exact Ruby version and patchlevel running in production (you need to know whether it’s Ruby 1.8.6 before p369 or Ruby 1.8.7 before p173).
• Identify whether the application is internet-facing or otherwise reachable from untrusted networks.
• Look for request-handling code that converts user-provided strings into numeric/decimal values (for example, any paths that parse or transform “number-like” input using BigDecimal).

Upgrade to fixed versions

• If on Ruby 1.8.6: upgrade to Ruby 1.8.6 p369 or later.
• If on Ruby 1.8.7: upgrade to Ruby 1.8.7 p173 or later.
• After upgrade, confirm the application starts cleanly and that number-handling/parsing features still work.

If you cannot patch immediately (temporary reduction)

• As an interim measure, restrict network access to the service (e.g., allow only trusted IPs/VPN) to reduce the chance that an external attacker can reach the vulnerable code path.
• Add/request-level input validation: reject or cap the size/format of any user-provided numeric strings before they reach BigDecimal conversion.

What to monitor after changes

• Application crash logs and restarts correlated with incoming requests.
• Any repeated error signatures around numeric parsing/BigDecimal usage.
• If you have WAF/load balancer logs, look for requests containing unusually large numeric strings.

CVE-2009-1904 is a denial-of-service weakness (CWE-189) in Ruby’s BigDecimal when parsing certain string inputs representing extremely large numeric values. The findings indicate network reachability without authentication, and a crafted input can force processing of an overly large numeric value that stops the application unexpectedly (a crash).

Exploitation status: a public exploit is available (1 known). KEV is not listed in CISA KEV, so it is not confirmed as a widely deployed KEV case from the provided findings.

Attack vector: remote attacker sends a specially crafted string “number” via a network request; BigDecimal conversion logic is the triggering mechanism.

EPSS is reported as 12.8% with a rising trend, but since no KEV/news confirmation is provided here, treat that as indicative rather than proof of current widespread exploitation.