Marek Hulan (mhulan) reports:

I found a DoS bug in foreman. The problem is in converting a user input into a 
symbol. Since MRI garbage collector does not free any instantiated symbol any 
authenticated user can create inputs to consume all system memory. Memory 
consumption is linear (input size = consumed memory amount) and every input 
must be unique. Since the input comes from HTTP request via method PUT it's 
not hard to send large portion of data at a time. Basically an attacker is 
just limited by HTTP protocol and server configuration.