A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.

Summary

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

Timeline

1. Mar 31, 2023, 12:00 AM UTCCVE published
2. Feb 14, 2025, 7:38 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Nov 4, 2025, 5:12 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• uriRubyGems

  From 0.12.0 · fixed in 0.12.1

• uriRubyGems

  From 0.11.0 · fixed in 0.11.1

• uriRubyGems

  From 0.10.1 · fixed in 0.10.2

• uriRubyGems

  fixed in 0.10.0.1

References 12