Denial of Service Vulnerability in Ring Web Applications Library by Clojure
CVE-2026-62864

7.5HIGH

Key Information:

Vendor

Ring-clojure

Status
Ring
Vendor
CVE Published:
30 October 2026

What is CVE-2026-62864?

The Ring web applications library for Clojure has a vulnerability in its wrap-nested-params middleware, which employs a backtracking regular expression for matching parameter names in URL query strings and HTTP request bodies. This design flaw allows attackers to craft malicious parameter names that can trigger quadratic time complexity during the matching process, resulting in a denial of service condition. Users of the Ring-Defaults are particularly at risk, as the nested-params middleware is enabled by default. Organizations using affected versions are advised to upgrade to version 1.15.5 or later to mitigate this risk.

Affected Version(s)

ring < 1.15.5

References

https://github.com/ring-clojure/ring/security/advisories/...
x_refsource_CONFIRM
https://github.com/ring-clojure/ring/commit/18738cbb8ab75...
x_refsource_MISC
https://github.com/ring-clojure/ring/tree/1.15.5
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.