CVE-2023-28755mediumCWE-1333

CVE-2023-28755

Published · Updated

Follow this CVE+ Monitor ruby+ Monitor ruby3.1

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 2.6%
In short

Ruby's URI parser becomes extremely slow when processing certain malformed URLs, potentially causing a denial of service. An attacker can send specially crafted URLs to freeze or exhaust a web application's resources.

Technical detail

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Ruby's URI component (versions up to 0.12.0) where invalid URLs with specific character patterns trigger catastrophic backtracking in the parser. Attack vector is network-based; attacker supplies malformed URLs to trigger exponential processing time. Impact includes CPU exhaustion and application unavailability.

Summary generated and translated by AI from the official description.
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
n/a · n/a