CVE-2023-22796

State: Published
Severity: Not scored
Published: Feb 9, 2023
Updated: Nov 27, 2024
Reserved: Jan 6, 2023

Description

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Scores

The record has no CVSS score.

Weaknesses

CWE-400 Denial of Service (CWE-400)

Affected Products

Product	Versions
https://github.com/rails/railsn/a	6.1.7.1, 7.0.4.1Affected

References

https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116
DSA-5372vendor-advisory
https://security.netapp.com/advisory/ntap-20240202-0009/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.