# CPU usage with 2-2-CVE-2009-3009.patch and 2.2.2

**URL:** <https://www.ruby-forum.com/t/cpu-usage-with-2-2-cve-2009-3009-patch-and-2-2-2/175303>\
**Category:** Rails\
**Created:** [September 10, 2009, 10:17pm UTC](https://www.ruby-forum.com/t/cpu-usage-with-2-2-cve-2009-3009-patch-and-2-2-2/175303 "2009-09-10T22:17:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Grant\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@Grant\_H](https://www.ruby-forum.com/u/Grant_H)\
**Post date:** [September 10, 2009, 10:17pm UTC](https://www.ruby-forum.com/t/cpu-usage-with-2-2-cve-2009-3009-patch-and-2-2-2/175303/1 "2009-09-10T22:17:50Z")

</div>

We have applied the XSS vulnerability patch to the Rails 2.2.2  
codebase and built our own version of the 2.2.2 gems.

When we run with this patched 2.2.2, we are seeing high CPU usage  
which seems to be a direct result of the additional UTF-8 checking.  
Unfortunately it has increased CPU load so much that we are no longer  
able to keep up with the requests coming in.

One idea we’ve had is to try to minimize the use of tag helpers in our  
application, but that seems like a pretty drastic step to take  
considering that before the patch we had plenty of headroom. The  
increase in CPU load is high enough that it seems like there could be  
room for optimization in this patch.

Has anyone else run into this issue? Does anyone know of a good way to  
improve performance in this area?

---

<div class="post-metadata">

**Author:** ![Grant\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@Grant\_H](https://www.ruby-forum.com/u/Grant_H)\
**Post date:** [September 11, 2009, 1:13am UTC](https://www.ruby-forum.com/t/cpu-usage-with-2-2-cve-2009-3009-patch-and-2-2-2/175303/2 "2009-09-11T01:13:27Z")

</div>

Someone else had the same problem and posted a ticket to Lighthouse  
with a workaround patch.

The patch completely fixes our problem.

[https://rails.lighthouseapp.com/projects/8994/tickets/3181-patch-activesupportmultibyteclean-is-very-slow](https://rails.lighthouseapp.com/projects/8994/tickets/3181-patch-activesupportmultibyteclean-is-very-slow)

On Sep 10, 3:15 pm, Grant H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Grant\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@Grant\_H](https://www.ruby-forum.com/u/Grant_H)\
**Post date:** [September 11, 2009, 3:17am UTC](https://www.ruby-forum.com/t/cpu-usage-with-2-2-cve-2009-3009-patch-and-2-2-2/175303/3 "2009-09-11T03:17:34Z")

</div>

Applied. Another 2.3 point release is pending to fix Ruby 1.9  
compatibility.

Best,  
jeremy

On Thu, Sep 10, 2009 at 4:11 PM, Grant H.