CVE-2023-36617

MEDIUM

URI < 0.10.3 - Inefficient Regular Expression Complexity in RFC Parser

Title source: llm

Description

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

References (6)

Core 6

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html

Mitigation, Vendor Advisory

https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/

Vendor Advisory

https://security.netapp.com/advisory/ntap-20230725-0002/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/

Scores

CVSS v3 5.3

EPSS 0.0153

EPSS Percentile 71.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE

CWE-1333

Status published

Products (2)

ruby-lang/uri < 0.10.3

rubygems/uri 0.10.1 - 0.10.3RubyGems

Published Jun 29, 2023

Tracked Since Feb 18, 2026