CVE-2023-22796: ReDoS based DoS vulnerability in Active Support's underscore

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-10-24
Weakness: CWE-400

Description

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Affected products

Activesupport Project Activesupport: before 6.1.7.1; from 7.0.0 before 7.0.4.1 — fixed in 6.1.7.1, 7.0.4.1
Rubygems Activesupport: before 6.1.7.1; from 7.0.0 before 7.0.4.1; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0 (+412) — fixed in 6.1.7.1, 7.0.4.1

How to fix

Upgrade to a fixed version: Activesupport Project Activesupport 6.1.7.1, 7.0.4.1; Rubygems Activesupport 6.1.7.1, 7.0.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22796 or the next vulnerability affects your stack