MediumFix available
jruby, ruby3.1 — security advisory
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
- Products
- jruby, ruby3.1
- Affected versions
- 10.1.1.0+ds-1~exp1, 10.1.1.0+ds-1~exp2, 10.1.2.0+ds-1, 3.1.2-7, 3.1.2-7+deb12u1, 3.1.2-7+hurd.1, 3.1.2-8, 3.1.2-8.1~exp1, 3.1.2-8.3, 3.1.2-8.4, 3.1.2-8.5, 9.3.9.0+ds-8, 9.4.12.0+ds-1~exp1, 9.4.14.0+ds-1, 9.4.14.0+ds-1~exp1, 9.4.3.0+ds-1~exp1, 9.4.3.0+ds-1~exp2, 9.4.5.0+ds-1, 9.4.5.0+ds-1~exp1, 9.4.6.0+ds-1, 9.4.6.0+ds-1.1, 9.4.8.0+ds-1, 9.4.8.0+ds-2, 9.4.8.0+ds-3
- Fixed versions
- 9.4.5.0+ds-1
- CVEs
- CVE-2023-28756
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 15:32 UTC · Revision 1
Source evidence
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
osv:DEBIAN-CVE-2023-28756
jruby
Fixed versions: Not specified
jruby
Fixed versions: 9.4.5.0+ds-1
jruby
Fixed versions: 9.4.5.0+ds-1
ruby3.1
Fixed versions: Not specified
Complete source record
{
"id": "cad2a5818714f78b554453faab7a3d745b9f4bb072a9c557b529c08490fbd7f7",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-28756",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-28756",
"summary": "A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.",
"evidence": "osv:DEBIAN-CVE-2023-28756",
"products": [
{
"name": {
"value": "jruby",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.1.1.0+ds-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "10.1.1.0+ds-1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "10.1.2.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.3.9.0+ds-8",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.12.0+ds-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.14.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.14.0+ds-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.3.0+ds-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.3.0+ds-1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.5.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.5.0+ds-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.6.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.6.0+ds-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.8.0+ds-1",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.8.0+ds-2",
"evidence": "/affected/0/versions"
},
{
"value": "9.4.8.0+ds-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "jruby",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.4.5.0+ds-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jruby",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.4.5.0+ds-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ruby3.1",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.2-7",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-7+deb12u1",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-7+hurd.1",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-8",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-8.1~exp1",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-8.3",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-8.4",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.2-8.5",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2023-28756",
"aliases": [
"DEBIAN-CVE-2023-28756"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"10.1.1.0+ds-1~exp1",
"10.1.1.0+ds-1~exp2",
"10.1.2.0+ds-1",
"9.3.9.0+ds-8",
"9.4.12.0+ds-1~exp1",
"9.4.14.0+ds-1",
"9.4.14.0+ds-1~exp1",
"9.4.3.0+ds-1~exp1",
"9.4.3.0+ds-1~exp2",
"9.4.5.0+ds-1",
"9.4.5.0+ds-1~exp1",
"9.4.6.0+ds-1",
"9.4.6.0+ds-1.1",
"9.4.8.0+ds-1",
"9.4.8.0+ds-2",
"9.4.8.0+ds-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28756.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.5.0+ds-1"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28756.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.5.0+ds-1"
}
]
}
],
"package": {
"name": "jruby",
"purl": "pkg:deb/debian/jruby?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28756.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby3.1",
"purl": "pkg:deb/debian/ruby3.1?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.1.2-7",
"3.1.2-7+deb12u1",
"3.1.2-7+hurd.1",
"3.1.2-8",
"3.1.2-8.1~exp1",
"3.1.2-8.3",
"3.1.2-8.4",
"3.1.2-8.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28756.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:01:02.812604249Z",
"provider": "osv",
"upstream": [
"CVE-2023-28756"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-28756"
]
},
"related_cves": [
{
"value": "CVE-2023-28756",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 455303,
"published_at": "2023-03-31T04:15:09.09+00:00"
}