CVE-2023-28756: Ruby-lang Ruby ReDoS Vulnerability

CVE-2023-28756 Overview

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Time component through version 0.2.1 in Ruby through version 3.2.1. The Time parser mishandles invalid URLs that contain specific characters, causing an exponential increase in execution time when parsing certain malformed strings to Time objects. This vulnerability allows remote attackers to cause denial of service conditions by supplying crafted input strings that trigger catastrophic backtracking in the regular expression engine.

Critical Impact

Remote attackers can exploit this vulnerability to cause significant CPU resource exhaustion on Ruby applications that parse user-controlled time strings, potentially leading to service degradation or complete denial of service.

Affected Products

• Ruby-lang Ruby through version 3.2.1
• Ruby-lang Time versions 0.1.0 and 0.2.1
• Debian Linux 10.0
• Fedora 36, 37, and 38

Discovery Timeline

• March 30, 2023 - Ruby-lang releases security advisory for CVE-2023-28756
• March 31, 2023 - CVE-2023-28756 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2023-28756

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS. The Ruby Time component uses regular expressions to parse time strings, but certain patterns in the regex allow for catastrophic backtracking when processing specially crafted input. When the Time parser encounters invalid URLs with specific character sequences, the regex engine enters a state where it must explore an exponentially growing number of possible matches before determining that no match exists.

The impact is limited to availability, as the vulnerability does not allow for code execution or data disclosure. However, in web applications or services that parse user-supplied time strings, an attacker can submit malicious input that causes worker processes to become unresponsive, effectively denying service to legitimate users.

Root Cause

The root cause lies in the regular expression patterns used within the Ruby Time component for parsing time strings. The regex contains nested quantifiers or overlapping alternations that create ambiguity in how the input string can be matched. When the parser receives a carefully crafted string that nearly matches the expected pattern but ultimately fails, the regex engine must exhaustively backtrack through all possible matching combinations before concluding that no match exists.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or privileges. An attacker simply needs to identify an application endpoint that processes time strings using the vulnerable Ruby Time component and submit a malicious string designed to trigger the exponential backtracking behavior.

The vulnerability is particularly dangerous in scenarios where:

• Web applications accept date/time input from users
• APIs parse time-related headers or parameters
• Background workers process time strings from external sources

The attack requires minimal complexity to execute, as the malicious input strings are well-documented and the exploitation pattern is straightforward. No user interaction is required for the attack to succeed.

Detection Methods for CVE-2023-28756

Indicators of Compromise

• Abnormally high CPU utilization on application servers processing time-related input
• Ruby worker processes becoming unresponsive or timing out during time parsing operations
• Increased request latency specifically on endpoints that handle date/time parameters
• Application logs showing timeout errors related to Time parsing functions

Detection Strategies

• Monitor Ruby application performance metrics for sudden spikes in CPU usage correlated with time parsing operations
• Implement request timeout monitoring to detect unusually long-running time parsing operations
• Deploy application performance monitoring (APM) to track method-level execution times in the Time component
• Use static code analysis to identify locations where user input is passed to Time.parse or related methods

Monitoring Recommendations

• Set up alerts for CPU utilization thresholds on Ruby application servers
• Configure request timeout logging to capture slow requests involving time parsing
• Implement rate limiting on endpoints that accept time-related input to mitigate exploitation attempts
• Monitor application health endpoints to quickly detect service degradation

How to Mitigate CVE-2023-28756

Immediate Actions Required

• Upgrade the Ruby Time gem to version 0.1.1 or 0.2.2 which contain the fix for this vulnerability
• Update Ruby to version 3.2.2 or later which includes the patched Time component
• Implement input validation to reject malformed time strings before they reach the Time parser
• Add request timeouts around time parsing operations to prevent individual requests from consuming excessive resources

Patch Information

The vulnerability has been fixed in Time gem versions 0.1.1 and 0.2.2. Users should update their Ruby installations or the Time gem directly to receive the security fix. Ruby-lang has published a detailed security advisory with patching instructions. Additional security advisories have been issued by Debian, Fedora, Gentoo, and NetApp.

Workarounds

• Implement input length limits on time string parameters to reduce the potential for exploitation
• Add input validation using a simple regex pre-check before passing strings to Time.parse
• Wrap time parsing operations in timeout blocks to prevent runaway CPU consumption
• Consider using alternative time parsing libraries that are not affected by this vulnerability until patching is complete

# Update the Time gem to the patched version
gem update time

# Or specify the patched version in your Gemfile
# gem 'time', '>= 0.2.2'

# Then run bundle update
bundle update time