CVE-2023-28755mediumCWE-1333

CVE-2023-28755

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 2.6%

exploitation probability

2.6%top 15% of all CVEs

observed exploitation

nono source reports it

In short

Ruby's URI parser becomes extremely slow when processing certain malformed URLs, potentially causing a denial of service. An attacker can send specially crafted URLs to freeze or exhaust a web application's resources.

Technical detail

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Ruby's URI component (versions up to 0.12.0) where invalid URLs with specific character patterns trigger catastrophic backtracking in the parser. Attack vector is network-based; attacker supplies malformed URLs to trigger exponential processing time. Impact includes CPU exhaustion and application unavailability.

Summary generated and translated by AI from the official description.

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

n/a · n/a

References