PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2023-27539

CVE-2023-27539

rubygem-rack: denial of service in header parsing

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · March 15, 2023

Updated · June 28, 2026

Description

A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1333 · Inefficient Regular Expression Complexity