Medium severity · published Jun 29, 2023
CVE-2023-36617
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Uri · Ruby-lang
before 0.10.3; 0.11.0 before 0.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-36617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-36617
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
security.netapp.com
https://security.netapp.com/advisory/ntap-20230725-0002/
Mitigation
https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
More from Uri
7.5
CVE-2025-61594
URI Credential Leakage Bypass over CVE-2025-27221
5.3
CVE-2025-27221
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained…
5.3
CVE-2023-28755
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1