A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

🗓️ 18 Feb 2023 08:00:00Reported by MicrosoftType

Regex DoS in Action Dispatch via If-None-Match; affects Ruby below 3.2.0; upgrade or apply workaround.

Reporter	Title	Published	Views	Family All 69
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	20 Jun 202400:38	–	ibm
ATTACKERKB	CVE-2023-22795	9 Feb 202320:15	–	attackerkb
AlpineLinux	CVE-2023-22795	9 Feb 202320:15	–	alpinelinux
CBLMariner	CVE-2023-22795 affecting package ruby 2.6.10-1	12 Jan 202509:15	–	cbl_mariner
CBLMariner	CVE-2023-22795 affecting package ruby for versions less than 3.1.4-1	25 May 202309:38	–	cbl_mariner
Circl	CVE-2023-22795	9 Feb 202322:26	–	circl
CNNVD	actionpack 安全漏洞	20 Jan 202300:00	–	cnnvd
CVE	CVE-2023-22795	9 Feb 202300:00	–	cve
Cvelist	CVE-2023-22795	9 Feb 202300:00	–	cvelist