Read the docs
TI-2021-18443 Aliases CVE-2021-41817GHSA-qg54-694p-wgpp

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial…

Priority LOW 39CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Why it matters now

EPSS 0.03463 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial date (RubyGems): 3.2.1, 3.1.2, 3.0.2 +1Red Hat: 10 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—date (RubyGems)3.2.0 to before 3.2.13.2.1Patch availableGHSA-qg54-694p-wgpp
—date (RubyGems)3.1.0 to before 3.1.23.1.2Patch availableGHSA-qg54-694p-wgpp
—date (RubyGems)3.0.0 to before 3.0.23.0.2Patch availableGHSA-qg54-694p-wgpp
—date (RubyGems)before 2.0.12.0.1Patch availableGHSA-qg54-694p-wgpp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • date (RubyGems) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-qg54-694p-wgpp
  • date (RubyGems) Vendor— Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-qg54-694p-wgpp
  • date (RubyGems) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-qg54-694p-wgpp
  • date (RubyGems) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-qg54-694p-wgpp

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:date:*:*:*:*:*:ruby:*:*before 2.0.1; 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2Vulnerableruby
cpe:2.3:a:ruby-lang:date:3.2.0:*:*:*:*:ruby:*:*3.2.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*2.6.0 to before 2.6.9; 2.7.0 to before 2.7.5; 3.0.0 to before 3.0.3Vulnerableruby
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:ruby-lang:date:*:*:*:*:*:ruby:*:* Versions before 2.0.1; 3.0.0 to before 3.0.2; 3.1.0 to before 3.1.2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:date:3.2.0:*:*:*:*:ruby:*:* Versions 3.2.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.9; 2.7.0 to before 2.7.5; 3.0.0 to before 3.0.3 Vulnerable ·ruby
  • cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*12.0VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*15.0VulnerableSUSE
cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:*not specified by NVDVulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·SUSE
  • cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-qg54-694p-wgpp date (RubyGems) Fixed in 3.2.1 Advisory →
  • Fix · GHSA-qg54-694p-wgpp date (RubyGems) Fixed in 3.1.2 Advisory →
  • Fix · GHSA-qg54-694p-wgpp date (RubyGems) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-qg54-694p-wgpp date (RubyGems) Fixed in 2.0.1 Advisory →

Red Hat 10 advisories

  • RHSA-2022:6856 Released 2022-10-11 · Red Hat rating Moderate
    rh-ruby27-ruby security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby27-ruby-2.7.6-131.el7, rh-ruby27-ruby-devel-2.7.6-131.el7, rh-ruby27-ruby-doc-2.7.6-131.el7 +19
    • Red Hat Software Collections for RHEL(v. 7) rh-ruby27-ruby-2.7.6-131.el7, rh-ruby27-ruby-devel-2.7.6-131.el7, rh-ruby27-ruby-doc-2.7.6-131.el7 +19
  • RHSA-2022:6855 Released 2022-10-11 · Red Hat rating Moderate
    rh-ruby30-ruby security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
    • Red Hat Software Collections for RHEL(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
  • RHSA-2022:6450 Released 2022-09-13 · Red Hat rating Moderate
    ruby:3.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.aarch64::ruby:3.0, ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686::ruby:3.0, ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.ppc64le::ruby:3.0 +47
Show 7 more Red Hat advisories
  • RHSA-2022:6447 Released 2022-09-13 · Red Hat rating Moderate
    ruby:2.7 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64::ruby:2.7, ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686::ruby:2.7, ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le::ruby:2.7 +47
  • RHSA-2022:5779 Released 2022-08-01 · Red Hat rating Moderate
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.aarch64::ruby:2.5, ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.i686::ruby:2.5, ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.ppc64le::ruby:2.5 +47
  • RHSA-2022:0708 Released 2022-02-28 · Red Hat rating Important
    rh-ruby26-ruby security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
    • Red Hat Software Collections for RHEL(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
  • RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
  • RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
  • RHSA-2022:0544 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) ruby-2.6.9-108.module+el8.4.0+14070+b3717926.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.i686::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.ppc64le::ruby:2.6 +47
  • RHSA-2022:0543 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.i686::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.ppc64le::ruby:2.6 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:0543, RHSA-2022:5779, RHSA-2022:6447, RHSA-2022:6450
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:0581
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:0582
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0544
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0708, RHSA-2022:6855, RHSA-2022:6856
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0708, RHSA-2022:6855, RHSA-2022:6856
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41817
  2. 2026-10-03 Alias added: GHSA-qg54-694p-wgpp

References

Exploit 1

Advisory 4

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences