CVE-2014-9490: sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number
5
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.7183%
CWE
Published
10/24/2017
Updated
11/5/2023
KEV Status
No
Technology
Ruby
Technical Details
CVSS Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sentry-raven | rubygems | < 0.12.2 | 0.12.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from the numtok() function's handling of scientific notation in JSON parsing. The original code converted exponents by performing 10^N computations, which becomes computationally expensive for large N values. The patch explicitly removes this computation and returns the raw string instead. The CVE description, commit diff, and test case changes all directly implicate this function as the vulnerable component.