CVE-2023-36617 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the URI component in Ruby versions prior to 0.12.2 and 0.10.3. This flaw stems from an incomplete fix for a previous vulnerability, allowing specially crafted invalid URLs to significantly increase parsing execution time. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity and a low impact on availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.10.3CPE matchmatch criteria | cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:* | ||
>= 0.11.0, < 0.12.2CPE matchmatch criteria | cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-36617
Jul 11, 2023URI gem has ReDoS vulnerability
Jun 29, 2023rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755
Jun 29, 2023A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
Jun 13, 2023