# Denial of Service in Action Pack Exception Handling

Deeply nested hash params in Rack/Rails trigger recursive normalize_encode_params, causing unhandled SystemStackError and DoS on single-threaded servers.

- Payout: hidden
- Severity: medium
- Program: Ruby on Rails
- Found by: ff7f00
- Disclosed: 2015-06-16
- CVE: CVE-2015-3225
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/42797
- Library page: https://bugbountylibrary.com/r/h1%3A42797
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos

**Target:** Action Pack / Rack parameter parsing (HTTP request params)
**Root cause:** Recursive normalize_encode_params in action_dispatch/http/parameters.rb recurses on deeply nested hash params; the SystemStackError raised during exception logging re-invokes normalization, looping and exhausting resources.
**Steps:**
1. Create a Rails app with a route and run it in production on WEBrick.
2. Send a GET request with body `foo[a][a]...[a]=bar` nested hundreds of levels deep via curl --data-binary.
3. Server raises SystemStackError in normalize_encode_params, then again during exception logging, hangs and must be killed.
4. Add more `[a]` levels if the server survives the initial depth.
**How found:** Researcher set a byebug breakpoint in Request GET/POST, caught SystemStackError, and observed it re-raised during exception logging, tracing it to the recursive normalize_encode_params method.
**Exploitation:** A single crafted request with a very deeply nested parameter hash hangs a single-threaded WEBrick/Thin process; concurrent requests against Unicorn kill workers repeatedly, making the app unavailable (demonstrated on Heroku).
**Escalation:** Scaling with many concurrent requests to exhaust multi-worker servers like Unicorn.
**Insight:** When a parser recurses on attacker-controlled nesting, check whether the error-handling/logging path re-invokes the same parser — that turns a caught error into an unhandled loop and amplifies DoS.