High
ruby-globalid — security advisory
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
- Products
- ruby-globalid
- Affected versions
- 0.3.6-1, 0.4.2+REALLY.0.3.6-1, 0.6.0-1, 0.6.0-2, 1.2.1-1, 1.2.1-2, 1.3.0-1, 1.4.0-1
- Fixed versions
- Not specified
- CVEs
- CVE-2023-22799
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:48 UTC · Revision 1
Source evidence
A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
osv:UBUNTU-CVE-2023-22799
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
ruby-globalid
Fixed versions: Not specified
Complete source record
{
"id": "63a3aebf5aa62aabb02579ccb0614c543d4545da6590e143cc75354db242c393",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-22799",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2023-22799",
"summary": "A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.",
"evidence": "osv:UBUNTU-CVE-2023-22799",
"products": [
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.3.6-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.3.6-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.2+REALLY.0.3.6-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.2+REALLY.0.3.6-1",
"evidence": "/affected/3/versions"
},
{
"value": "0.6.0-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.6.0-2",
"evidence": "/affected/4/versions"
},
{
"value": "1.2.1-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.2.1-2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.3.0-1",
"evidence": "/affected/6/versions"
},
{
"value": "1.4.0-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "ruby-globalid",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.2.1-2",
"evidence": "/affected/7/versions"
},
{
"value": "1.3.0-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2023-22799",
"aliases": [
"UBUNTU-CVE-2023-22799"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.3.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "0.3.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.3.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "0.3.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.4.2+REALLY.0.3.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "0.4.2+REALLY.0.3.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.4.2+REALLY.0.3.6-1",
"0.6.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "0.6.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.6.0-2",
"1.2.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "1.2.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.2.1-1",
"1.2.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "1.2.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.3.0-1",
"1.4.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "1.4.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-globalid",
"purl": "pkg:deb/ubuntu/ruby-globalid?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.2.1-2",
"1.3.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-22799.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-globalid",
"binary_version": "1.3.0-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:04.095765644Z",
"provider": "osv",
"upstream": [
"CVE-2023-22799"
],
"references": [
"https://ubuntu.com/security/CVE-2023-22799",
"https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127",
"https://github.com/rails/globalid/commit/3bc4349422e60f2235876a59dd415e98b072eb2b",
"https://www.cve.org/CVERecord?id=CVE-2023-22799"
]
},
"related_cves": [
{
"value": "CVE-2023-22799",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354746,
"published_at": "2023-02-09T20:15:00+00:00"
}