Read the docs
TI-2023-08968 Aliases CVE-2023-22796GHSA-j6gc-792m-qgm2

Uncontrolled resource consumption in https://github.com/rails/rails

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01712 77th percentileScored 2026-11-07
Fix Partial activesupport (RubyGems): 6.1.7.1, 7.0.4.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rails/rails6.1.7.1, 7.0.4.1—No fix listedCNA
—activesupport (RubyGems)before 6.1.7.16.1.7.1Patch availableGHSA-j6gc-792m-qgm2
—activesupport (RubyGems)7.0.0 to before 7.0.4.17.0.4.1Patch availableGHSA-j6gc-792m-qgm2
  • https://github.com/rails/rails Vendor— Affected 6.1.7.1, 7.0.4.1 Fixed in — No fix listed CNA
  • activesupport (RubyGems) Vendor— Affected before 6.1.7.1 Fixed in 6.1.7.1 Patch available GHSA-j6gc-792m-qgm2
  • activesupport (RubyGems) Vendor— Affected 7.0.0 to before 7.0.4.1 Fixed in 7.0.4.1 Patch available GHSA-j6gc-792m-qgm2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:activesupport_project:activesupport:*:*:*:*:*:ruby:*:*before 6.1.7.1; 7.0.0 to before 7.0.4.1VulnerableActivesupport Project
  • cpe:2.3:a:activesupport_project:activesupport:*:*:*:*:*:ruby:*:* Versions before 6.1.7.1; 7.0.0 to before 7.0.4.1 Vulnerable ·Activesupport Project

Remediation

  • Fix · GHSA-j6gc-792m-qgm2 activesupport (RubyGems) Fixed in 6.1.7.1 Advisory →
  • Fix · GHSA-j6gc-792m-qgm2 activesupport (RubyGems) Fixed in 7.0.4.1 Advisory →

Red Hat 2 advisories

  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
  • RHSA-2023:4341 Released 2023-08-02 · Red Hat rating Moderate
    Logging Subsystem 5.7.4 - Red Hat OpenShift bug fix and security update
    • RHOL 5.7 for RHEL 8 openshift-logging/fluentd-rhel8, openshift-logging/logging-view-plugin-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
RHOL 5.7 for RHEL 8Fixed RHSA-2023:4341
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Not affected: 3 products
  • RHOL 5.7 for RHEL 8
  • Red Hat Satellite 6
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22796
  2. 2026-10-03 Alias added: GHSA-j6gc-792m-qgm2

References

Patch 1

Advisory 2

Other 8

  • TI-2018-02773 Command injection in HackerOne active-support ruby gem CVSS 3.0CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences