Memory leak in gem decode logic can allow attacker to take down Rubygems.org application

Summary

The reporter discovered that pushing a gem via POST /api/v1/gems causes gem metadata to be decoded through Gem::Specification, which allows arbitrary instance variables to be set via instance_variable_set. Because Ruby doesn't garbage collect symbols created this way, an attacker with a valid API key could exhaust server memory by sending requests with a large number of unique key-value pairs in the gem metadata.

We've addressed this by restricting which instance variables can be set during metadata decoding. The fix is in this commit. Severity is Medium (6.5) given that exploitation requires a valid API key and the impact is confined to rubygems.org. Thanks to @mclaren650sspider for the clear, well-documented report including a working exploit script.