CVE-2023-22792: ReDoS based DoS vulnerability in Action Dispatch

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-10-24
Weakness: CWE-400

Description

A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected products

Ruby on Rails: from 3.0.0 before 6.0.6.1; from 6.1.0 before 6.1.7.1; from 7.0.0 before 7.0.4.1 — fixed in 6.0.6.1, 6.1.7.1, 7.0.4.1
Rubygems Actionpack: from 3.0.0 before 5.2.8.15; from 6.0.0 before 6.1.7.1; from 7.0.0 before 7.0.4.1; 3.0.0, 3.0.1, 3.0.10, 3.0.10.rc1, 3.0.11, 3.0.12 (+352) — fixed in 5.2.8.15, 6.1.7.1, 7.0.4.1

How to fix

Upgrade to a fixed version: Ruby on Rails 6.0.6.1, 6.1.7.1, 7.0.4.1; Rubygems Actionpack 5.2.8.15, 6.1.7.1, 7.0.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22792 or the next vulnerability affects your stack