QwikSec

Security Database

CVE

CWE

Training

CVE-2023-22796

Published: Feb 9, 2023

Modified: Nov 27, 2024

PUBLISHED

Description

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Vendor	Product	Versions
n/a	https://github.com/rails/rails	affected `6.1.7.1, 7.0.4.1`

Weaknesses (CWE)

References

https://discuss.rubyonrails.org/t/cve-2023-22796-possible-redos-based-dos-vulnerability-in-active-supports-underscore/82116

vendor-advisory

https://security.netapp.com/advisory/ntap-20240202-0009/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.