Symbols in Ruby are basically interned strings. So if you reference the symbol :foo, it will transparently get pinned in memory somewhere. Referencing :foo aga

Symbols in Ruby are basically interned strings. So if you reference the symbol :foo, it will transparently get pinned in memory somewhere. Referencing :foo again will not allocate an additional object - the interpreter will just give you the existing symbol. This is usually not an issue, because an application typically operates on a small, fixed set of known symbols. But if an attacker can generate arbitrary symbols (e.g. if you call .to_sym on user input), he can exhaust memory.