Denial of Service Vulnerability in Action Dispatch by Ruby on Rails

CVE-2023-22795

What is CVE-2023-22795?

A vulnerability exists in Action Dispatch related to the If-None-Match HTTP header in versions below 6.1.7.1 and 7.0.4.1. Exploitation can occur when a specially crafted header causes the regular expression engine to enter a state of catastrophic backtracking. This can result in excessive CPU and memory consumption on systems running Ruby versions prior to 3.2.0, potentially leading to service disruptions. Users are strongly advised to upgrade to the patched versions or implement available workarounds to mitigate risk.

References