CVE-2023-31606

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

• CWE-1333

• https://github.com/e23e/CVE-2023-31606#readmeExploit, Third Party Advisory
• https://github.com/jgarber/redclothProduct
• https://github.com/jgarber/redcloth/issues/73Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
• https://security.gentoo.org/glsa/202401-14
• https://github.com/e23e/CVE-2023-31606#readmeExploit, Third Party Advisory
• https://github.com/jgarber/redclothProduct
• https://github.com/jgarber/redcloth/issues/73Exploit, Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
• https://security.gentoo.org/glsa/202401-14

Published

Jun 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31587Tenda AC5 router V15.03.06.28 was discovered to contain a re…9.8
• CVE-2023-3159A use after free issue was discovered in driver/firewire in …6.7
• CVE-2023-31594IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Acc…7.5
• CVE-2023-31595IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Acc…7.5
• CVE-2023-31597An issue in Zammad v5.4.0 allows attackers to bypass e-mail …6.5
• CVE-2023-3160 The vulnerability potentially allows an attacker to misuse …7.8
• CVE-2023-31607An issue in the __libc_malloc component of openlink virtuoso…7.5
• CVE-2023-31608An issue in the artm_div_int component of openlink virtuoso-…7.5
• CVE-2023-31609An issue in the dfe_unit_col_loci component of openlink virt…7.5
• CVE-2023-3161A flaw was found in the Framebuffer Console (fbcon) in the L…5.5
• CVE-2023-31610An issue in the _IO_default_xsputn component of openlink vir…7.5
• CVE-2023-31611An issue in the __libc_longjmp component of openlink virtuos…7.5