https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 01:02:46 +0000 https://vulnerability.circl.lu/vuln/cve-2023-22796 <p><strong>Affected:</strong> https://github.com/rails/rails</p> <p>A regular expression based DoS vulnerability in Active Support &lt;6.1.7.1 and &lt;7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.</p> <p><strong>Affected:</strong> https://github.com/rails/rails</p> <p>A regular expression based DoS vulnerability in Active Support &lt;6.1.7.1 and &lt;7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.</p> https://vulnerability.circl.lu/vuln/cve-2023-22796 https://vulnerability.circl.lu/vuln/ghsa-j6gc-792m-qgm2 <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.</p> <p>Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1 Impact</p> <p>A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.</p> <p>This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.</p> <p>All users running an affected release should either upgrade or use one of the workarounds immediately. Releases</p> <p>The FIXED releases are available at the normal locations. Workarounds</p> <p>There are no feasible workarounds for this issue.</p> <p>Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout. Patches</p> <p>To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series 7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series</p> <p>Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users o…</p> <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.</p> <p>Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1 Impact</p> <p>A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.</p> <p>This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.</p> <p>All users running an affected release should either upgrade or use one of the workarounds immediately. Releases</p> <p>The FIXED releases are available at the normal locations. Workarounds</p> <p>There are no feasible workarounds for this issue.</p> <p>Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout. Patches</p> <p>To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series 7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series</p> <p>Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users o…</p> https://vulnerability.circl.lu/vuln/ghsa-j6gc-792m-qgm2