VulnerabilityModified
CVE-2023-28755
It causes an increase in execution time for parsing strings to URI objects.
MEDIUM 5.3EPSS 2.64%
Does this matter?
Lower severity and a low EPSS score (2.64%). Track it; it rarely justifies an emergency change on its own.
Description
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 2.64% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1333
- Affected
- ruby-lang/uri · debian/debian linux · fedoraproject/fedora
- Source
- cve@mitre.org
References
- https://github.com/ruby/uri/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0003/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/Vendor Advisory
- https://github.com/ruby/uri/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0003/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.