VYPR
← All advisories
High severityNVD Advisory· Published Mar 31, 2023· Updated Nov 4, 2025

CVE-2023-28756

CVE-2023-28756

Description

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A ReDoS vulnerability in Ruby's Time component allows attackers to cause denial of service by crafting invalid URLs that trigger excessive CPU consumption during string parsing.

Description

A ReDoS (Regular Expression Denial of Service) vulnerability exists in the Time component of Ruby, affecting versions up to 0.2.1 of the Time gem and Ruby versions through 3.2.1. The root cause is that the Time parser mishandles invalid URLs containing specific characters, leading to catastrophic backtracking in the regular expression engine. This results in a disproportionate increase in execution time when parsing such strings into Time objects [2][4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted string that, when parsed by an application using the Time component, causes the parser to consume excessive CPU resources. The attack requires no authentication if the application parses user-supplied strings, making it a low-complexity vector for denial of service [2].

Impact

Successful exploitation leads to a denial of service condition, where the affected Ruby process becomes unresponsive due to high CPU usage. This can degrade or completely disrupt the availability of the application [2].

Mitigation

The vulnerability is fixed in Time gem versions 0.1.1 and 0.2.2. Users should update the Time gem to one of these versions or upgrade Ruby to a release that incorporates the fix. No workarounds are documented [2][4].

References
  1. NVD - CVE-2023-28756
  2. ruby-advisory-db/gems/time/CVE-2023-28756.yml at master · rubysec/ruby-advisory-db

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
timeRubyGems
>= 0.2.0, < 0.2.20.2.2
timeRubyGems
< 0.1.10.1.1

Affected products

86

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

24

News mentions

0

No linked articles in our index yet.