What’s Vulnerable › Vulnerabilities

CVE-2024-43380: fugit parse and parse_nat stall on lengthy input

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-19 · updated 2026-06-17
• Weakness: CWE-400

Description

fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight. Fugit dependents that do not check (user) input length for plausibility are impacted. A fix was released in fugit 1.11.1.

Affected products

• floraison fugit: before 1.11.1 — fixed in 1.11.1
• Rubygems Fugit: before 1.11.1; 0.1.0, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4 (+48) — fixed in 1.11.1

How to fix

Upgrade to a fixed version: floraison fugit 1.11.1; Rubygems Fugit 1.11.1. Check the vendor advisory for mitigations.

References

• https://github.com/floraison/fugit/commit/ad2c1c9c737213d585fff0b51c927d178b2c05a5
• https://github.com/floraison/fugit/issues/104
• https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g

Get alerted when CVE-2024-43380 or the next vulnerability affects your stack