CVE-2023-36617
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
A ReDoS issue was discovered in the URI component before version 0.12.2 for Ruby. The URI parser mishandles invalid URLs with specific characters, leading to increased execution time when parsing strings to URI objects.
Risk Assessment
Organizations may be vulnerable to DoS attacks that could lead to application slowdowns or unavailability. The increased processing time may affect the performance of systems utilizing this component.
Recommendation
It is recommended to upgrade to version 0.12.2 or 0.10.3, which contain fixes for this vulnerability. Additionally, applications should be monitored for invalid URLs.
Original NVD description (English source)
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.