VYPR
← All advisories
High severityNVD Advisory· Published Mar 31, 2023· Updated Nov 4, 2025

CVE-2023-28755

CVE-2023-28755

Description

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A ReDoS vulnerability in Ruby's URI parser allows attackers to cause excessive CPU consumption by sending crafted invalid URLs, patched in versions 0.10.0.1, 0.10.2, 0.11.1, and 0.12.1.

Vulnerability

Overview

CVE-2023-28755 is a Regular Expression Denial of Service (ReDoS) vulnerability in the URI component of Ruby, affecting versions through 0.12.0 and Ruby through 3.2.1. The URI parser mishandles invalid URLs containing specific characters, causing a catastrophic exponential increase in execution time when parsing strings into URI objects [2]. This is a classic ReDoS issue where the regex engine spends excessive time backtracking on specially crafted input.

Exploitation

An attacker can exploit this vulnerability by providing a malformed URL string to an application that uses Ruby's URI library for parsing. No authentication is required, and the attack can be delivered remotely if the application processes user-supplied URLs (e.g., via HTTP parameters, API inputs, or file uploads). The crafted input triggers the pathological regex behavior, leading to high CPU usage and potential denial of service [1].

Impact

Successful exploitation causes a denial of service by exhausting server CPU resources, making the application unresponsive or severely degraded. The impact is limited to availability; there is no risk of data breach or code execution. The vulnerability is particularly concerning for web applications that perform URI validation or parsing of external URLs.

Mitigation

Ruby has released fixed versions of the URI gem: 0.10.0.1, 0.10.2, 0.11.1, and 0.12.1 [2]. Users should upgrade their URI gem to one of these versions. The Ruby language project recommends updating to the latest patch releases of the stable branches (e.g., Ruby 3.2.2 or later) [3]. As the issue is in the URI library, applications using Ruby gems that depend on the URI gem are also affected and should be updated [4].

References
  1. Ruby 3.2.0 Released | Ruby
  2. NVD - CVE-2023-28755
  3. Ruby Releases | Ruby
  4. Releases · ruby/uri

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
uriRubyGems
>= 0.12.0, < 0.12.10.12.1
uriRubyGems
>= 0.11.0, < 0.11.10.11.1
uriRubyGems
>= 0.10.1, < 0.10.20.10.2
uriRubyGems
< 0.10.0.10.10.0.1

Affected products

89

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

30

News mentions

0

No linked articles in our index yet.