MediumFix available
ruby — security advisory
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
- Products
- ruby
- Affected versions
- Not specified
- Fixed versions
- 2.7.8-r0, 3.0.6-r0, 3.1.4-r0
- CVEs
- CVE-2023-28756
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:57 UTC · Revision 1
Source evidence
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
osv:ALPINE-CVE-2023-28756
ruby
Fixed versions: 2.7.8-r0
ruby
Fixed versions: 3.0.6-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
ruby
Fixed versions: 3.1.4-r0
Complete source record
{
"id": "f69f9e633dad402ad7c73bc6663ad3d30bcf621442d36965e4445442cac89411",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2023-28756",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2023-28756",
"summary": "A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.",
"evidence": "osv:ALPINE-CVE-2023-28756",
"products": [
{
"name": {
"value": "ruby",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.8-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.0.6-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.4-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2023-28756",
"aliases": [
"ALPINE-CVE-2023-28756"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.8-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.6-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4-r0"
}
]
}
],
"package": {
"name": "ruby",
"purl": "pkg:apk/alpine/ruby?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-28756.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T17:17:58.619930722Z",
"provider": "osv",
"upstream": [
"CVE-2023-28756"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2023-28756"
]
},
"related_cves": [
{
"value": "CVE-2023-28756",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 454422,
"published_at": "2023-03-31T04:15:09.09+00:00"
}