CVE-2023-22799: ReDoS based DoS vulnerability in GlobalID

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-10-24
Weakness: CWE-400

Description

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected products

https://github.com/rails/globalid: from 0.2.1 before 1.0.1 — fixed in 1.0.1
Rubygems Globalid: from 0.2.1 before 1.0.1; 0.2.1, 0.2.2, 0.2.3, 0.3.0, 0.3.1, 0.3.2 (+12) — fixed in 1.0.1

How to fix

Upgrade to a fixed version: https://github.com/rails/globalid 1.0.1; Rubygems Globalid 1.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22799 or the next vulnerability affects your stack