CVE-2023-22795: ReDoS based DoS vulnerability in Action Dispatch

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-10-24
Weakness: CWE-400

Description

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected products

Debian Linux: 11.0
Ruby on Rails: before 6.1.7.1; from 7.0.0 before 7.0.4.1 — fixed in 6.1.7.1, 7.0.4.1
Rubygems Actionpack: from 4.0.0.beta1 before 6.1.7.1; from 7.0.0 before 7.0.4.1; 4.0.0, 4.0.0.beta1, 4.0.0.rc1, 4.0.0.rc2, 4.0.1, 4.0.1.rc1 (+245) — fixed in 6.1.7.1, 7.0.4.1

How to fix

Upgrade to a fixed version: Ruby on Rails 6.1.7.1, 7.0.4.1; Rubygems Actionpack 6.1.7.1, 7.0.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22795 or the next vulnerability affects your stack