Ruby URI component ReDoS issue
High severity
GitHub Reviewed
Published
Mar 31, 2023
to the GitHub Advisory Database
•
Updated May 6, 2024
Package
Affected versions
= 0.12.0
= 0.11.0
= 0.10.1
< 0.10.0.1
Patched versions
0.12.1
0.11.1
0.10.2
0.10.0.1
Description
Published by the National Vulnerability Database
Mar 31, 2023
Published to the GitHub Advisory Database
Mar 31, 2023
Reviewed
Mar 31, 2023
Last updated
May 6, 2024
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
References