CVE-2023-28755
At a glance
- Source
- NVD
- EPSS
- EPSS 2.64 % · percentile 86 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
Weaknesses (CWE)
- CWE-1333 — Inefficient Regular Expression Complexity
References
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/
- https://www.ruby-lang.org/en/downloads/releases/
- https://github.com/ruby/uri/releases/
- https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://security.netapp.com/advisory/ntap-20230526-0003/
- https://security.gentoo.org/glsa/202401-27
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
- https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-hv5j-3h9f-99c2 — Ruby URI component ReDoS issue
European references
- ENISA EUVD · EUVD-2023-1038
- GCVE · GCVE-0-2023-28755
CERT-FR advisories
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*≤ 0.10.0cpe:2.3:a:ruby-lang:uri:0.10.1:*:*:*:*:ruby:*:*cpe:2.3:a:ruby-lang:uri:0.11.0:*:*:*:*:ruby:*:*cpe:2.3:a:ruby-lang:uri:0.12.0:*:*:*:*:ruby:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |