GitHub Advisoryadvisory · RubyGems

GHSA-hv5j-3h9f-99c2 Ruby URI component ReDoS issue

HIGH Published 2023-03-31 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-28755
Ecosystem
RubyGems
Packages
uri
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2023-03-31

Affected packages

• RubyGems uri: >= 0.12.0, < 0.12.1 → fixed in 0.12.1 • RubyGems uri: >= 0.11.0, < 0.11.1 → fixed in 0.11.1 • RubyGems uri: >= 0.10.1, < 0.10.2 → fixed in 0.10.2 • RubyGems uri: < 0.10.0.1 → fixed in 0.10.0.1

Description

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

Related

Alias · CVE (1)

  • CVE-2023-28755 A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References