HIGH 7.5 Microsoft

CVE-2023-22795

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Microsoft Security Update 2023-Feb: A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected Products

References

Published: 2023-02-14 · Source: Microsoft · Feed updated: 2026-08-20
This high severity vulnerability with a CVSS score of 7.5 was published on 2023-02-14 via Microsoft. Affected: cm1 ruby 2.6.10-1 on CBL Mariner 1.0, cbl2 ruby 3.1.4-1 on CBL Mariner 2.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.