Summary by Genius
After investigation, we discovered that when the fix for CVE-2022-44566 was backported to Rails 3 by the Rails LTS team, there were some paths inside the arel library where the fix was not correctly applied. These paths remained vulnerable to integer overflow. Further obscuring the issue was the fact that when the Genius engineering team was first notified of CVE-2022-44566 and evaluated the patches, we only evaluated the Rails 2 LTS versions of the patches, which did not have the same issue. When the Genius website was subsequently upgraded from Rails 2 LTS to Rails 3 LTS in 2025, this vulnerability was unknowingly introduced. We then worked with the Rails LTS team to correctly fix the integer overflow protection on all application paths, which were released as Rails LTS version 3.2.22.53.
Summary by ob_vr
Summary
The application fails to validate the {id} parameter, allowing excessively large integer inputs.
When such input is processed, the backend performs expensive operations instead of rejecting it, causing a worker thread to block for ~25 seconds.
Technical Details
- Endpoint:
/users/{id}/follows
- Method: POST
- Payload:
999999999999999999999999999999
- Issue: Lack of bounds validation on
{id}
- Behavior:
- Request is accepted and processed
- Backend attempts integer casting / database query
- Worker thread becomes blocked (~25 seconds)
- Eventually returns
500 Internal Server Error due to timeout
X-Runtime header confirms prolonged execution
Impact
- Each malicious request occupies one worker thread for ~25 seconds
- A small number of concurrent requests can exhaust the thread pool
- Results in complete application unavailability for legitimate users
- No high traffic required → low-effort DoS
