{"schema_version":"1.9.0","id":"GHSA-fg7x-g82r-94qc","published":"2023-03-31T06:30:15Z","modified":"2026-09-10T03:50:08.256309353Z","aliases":["BIT-ruby-2023-28756","BIT-ruby-min-2023-28756","CVE-2023-28756"],"summary":"Ruby Time component ReDoS issue","details":"A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.","affected":[{"package":{"name":"time","ecosystem":"RubyGems","purl":"pkg:gem/time"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.2.2"}]}],"versions":["0.2.0","0.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-fg7x-g82r-94qc/GHSA-fg7x-g82r-94qc.json"}},{"package":{"name":"time","ecosystem":"RubyGems","purl":"pkg:gem/time"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}],"versions":["0.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-fg7x-g82r-94qc/GHSA-fg7x-g82r-94qc.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28756"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released"},{"type":"WEB","url":"https://www.ruby-lang.org/en/downloads/releases"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230526-0004"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202401-27"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMIOPLBAAM3FEQNAXA2L7BDKOGSVUT5Z"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G76GZG3RAGYF4P75YY7J7TGYAU7Z5E2T"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFZANOQA4RYX7XCB42OO3P24DQKWHEKA"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/time/CVE-2023-28756.yml"},{"type":"WEB","url":"https://github.com/ruby/time/releases"},{"type":"PACKAGE","url":"https://github.com/ruby/time"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2023-03-31T22:43:54Z","nvd_published_at":"2023-03-31T04:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}