Read the docs
TI-2023-08965 Aliases CVE-2023-22792GHSA-p84v-45xj-wwqj

Uncontrolled resource consumption in https://github.com/rails/rails

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01695 77th percentileScored 2026-11-07
Fix Partial actionpack (RubyGems): 5.2.8.15, 6.1.7.1, 7.0.4.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rails/rails6.0.6.1, 6.1.7.1, 7.0.4.1—No fix listedCNA
—actionpack (RubyGems)3.0.0 to before 5.2.8.155.2.8.15Patch availableGHSA-p84v-45xj-wwqj
—actionpack (RubyGems)6.0.0 to before 6.1.7.16.1.7.1Patch availableGHSA-p84v-45xj-wwqj
—actionpack (RubyGems)7.0.0 to before 7.0.4.17.0.4.1Patch availableGHSA-p84v-45xj-wwqj
  • https://github.com/rails/rails Vendor— Affected 6.0.6.1, 6.1.7.1, 7.0.4.1 Fixed in — No fix listed CNA
  • actionpack (RubyGems) Vendor— Affected 3.0.0 to before 5.2.8.15 Fixed in 5.2.8.15 Patch available GHSA-p84v-45xj-wwqj
  • actionpack (RubyGems) Vendor— Affected 6.0.0 to before 6.1.7.1 Fixed in 6.1.7.1 Patch available GHSA-p84v-45xj-wwqj
  • actionpack (RubyGems) Vendor— Affected 7.0.0 to before 7.0.4.1 Fixed in 7.0.4.1 Patch available GHSA-p84v-45xj-wwqj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*3.0.0 to before 6.0.6.1; 6.1.0 to before 6.1.7.1; 7.0.0 to before 7.0.4.1VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 3.0.0 to before 6.0.6.1; 6.1.0 to before 6.1.7.1; 7.0.0 to before 7.0.4.1 Vulnerable ·Rails

Remediation

  • Fix · GHSA-p84v-45xj-wwqj actionpack (RubyGems) Fixed in 5.2.8.15 Advisory →
  • Fix · GHSA-p84v-45xj-wwqj actionpack (RubyGems) Fixed in 6.1.7.1 Advisory →
  • Fix · GHSA-p84v-45xj-wwqj actionpack (RubyGems) Fixed in 7.0.4.1 Advisory →

Red Hat 1 advisory

  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Not affected: 1 product
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22792
  2. 2026-10-03 Alias added: GHSA-p84v-45xj-wwqj

References

Patch 1

Advisory 2

Other 6

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences