CVE-2023-36617

🗓️ 29 Jun 2023 00:00:00Reported by mitreType

ReDoS issue in URI component for Ruby before 0.12.2. Mishandles invalid URLs with specific characters, leading to increased execution time

Reporter	Title	Published	Views	Family All 135
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
Tenable Nessus	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-839)	5 Feb 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:3.1 (ALSA-2024:1431)	21 Mar 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : ruby:3.1 (ALSA-2024:1576)	3 Apr 202400:00	–	nessus
Tenable Nessus	Debian dla-3858 : libruby2.7 - security update	2 Sep 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-2800)	16 Jan 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2023-2824)	16 Jan 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2023-2851)	16 Jan 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2023-2868)	16 Jan 202400:00	–	nessus

NVD

Node

ruby-lang uriRange<0.10.3ruby

ruby-lang uriRange0.11.0–0.12.2ruby

Source	Link
security	www.security.netapp.com/advisory/ntap-20230725-0002/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
ruby-lang	www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
lists	www.lists.debian.org/debian-lts-announce/2024/09/msg00000.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/

04 Nov 2025 18:15Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.00906