Description
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Metrics
CVSS 3.1 5.3/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://github.com/ruby/time/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory
- https://github.com/ruby/time/releases/Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z/
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20230526-0004/Third Party Advisory
- https://www.ruby-lang.org/en/downloads/releases/Release Notes
- https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
- https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/Vendor Advisory
Timeline
- Published
- Mar 31, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified