CVEvulnerability
CVE-2023-28755
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-03-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1333
Description
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
Affected configurations
• ruby-lang uri (<= 0.10.0)
• ruby-lang uri 0.10.1
• ruby-lang uri 0.11.0
• ruby-lang uri 0.12.0
• debian debian linux 10.0
• fedoraproject fedora 36
• fedoraproject fedora 37
• fedoraproject fedora 38
Related
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/ruby/uri/releases/ Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202401-27 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20230526-0003/ Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/ Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/ Release Notes
- https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/ Vendor Advisory
- https://github.com/ruby/uri/releases/ Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202401-27 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20230526-0003/ Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/ Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/ Release Notes
- https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/ Vendor Advisory