Cyber Resilience

CVE-2023-28755

Medium

Published: 31 March 2023

Published
31 March 2023
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0031 54.8th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28755 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Ruby-Lang Uri. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 45.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed…

more

versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CWE(s)
CWE-1333

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ruby-lang
uri
0.10.1, 0.11.0, 0.12.0 · ≤ 0.10.0
debian
debian linux
10.0
fedoraproject
fedora
36, 37, 38

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References