Cyber Resilience

CVE-2023-28756

Medium

Published: 31 March 2023

Published
31 March 2023
Modified
04 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0060 70.1th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28756 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Fedoraproject Fedora. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 29.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed…

more

versions are 0.1.1 and 0.2.2.

CWE(s)
CWE-1333

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ruby-lang
ruby
≤ 2.7.7
ruby-lang
time
0.1.0, 0.2.1
debian
debian linux
10.0
fedoraproject
fedora
36, 37, 38

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References