CVE-2023-36617

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

• CWE-1333

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
• https://security.netapp.com/advisory/ntap-20230725-0002/
• https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA6XUKUY7B5OLNQBLHOT43UW7C5NIOQQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27LUWREIFTP3MQAW7QE4PJM4DPAQJWXF/
• https://security.netapp.com/advisory/ntap-20230725-0002/
• https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/Mitigation, Vendor Advisory

Published

Jun 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36608 The affected TBox RTUs store hashed passwords using MD5 enc…6.5
• CVE-2023-36609 The affected TBox RTUs run OpenVPN with root privileges and…7.2
• CVE-2023-3661A vulnerability was found in SourceCodester AC Repair and Se…9.8
• CVE-2023-36610 ​The affected TBox RTUs generate software security tokens u…5.9
• CVE-2023-36611 The affected TBox RTUs allow low privilege users to access …6.5
• CVE-2023-36612Directory traversal can occur in the Basecamp com.basecamp.b…7.5
• CVE-2023-36618Atos Unify OpenScape Session Border Controller through V10 R…8.8
• CVE-2023-36619Atos Unify OpenScape Session Border Controller through V10 R…9.8
• CVE-2023-3662In CODESYS Development System versions from 3.5.17.0 and pri…7.3
• CVE-2023-36620An issue was discovered in the Boomerang Parental Control ap…4.6
• CVE-2023-36621An issue was discovered in the Boomerang Parental Control ap…9.1
• CVE-2023-36622The websocket configuration endpoint of the Loxone Miniserve…7.2