{"schemaVersion":3,"id":"CVE-2023-22799","aliases":["SUSE-SU-2023:0328-1","UBUNTU-CVE-2023-22799","DEBIAN-CVE-2023-22799","openSUSE-SU-2024:12648-1","openSUSE-SU-2024:13156-1","openSUSE-SU-2024:14168-1","openSUSE-SU-2025:15116-1","openSUSE-SU-2026:10347-1","GHSA-23c2-gwp5-pxw9"],"status":"published","duplicateOf":null,"title":null,"description":"A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.","dates":{"published":"2023-02-09T00:00:00.000Z","modified":"2024-08-02T10:20:30.834Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01049,"percentile":0.63742,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01049},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01049,"percentile":0.63742}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01049,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01049,"percentile":0.63742}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity","description":"The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/1333.html"}],"affected":[{"vendor":"debian","product":"ruby-globalid","name":"ruby-globalid","label":"ruby-globalid","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/ruby-globalid","purlType":"deb","versions":[{"text":"< 0.6.0-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.0-2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"ruby-globalid","name":"ruby-globalid","label":"ruby-globalid","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ruby-globalid","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"RubyGems","product":"globalid","name":"globalid","label":"globalid","ecosystem":"RubyGems","cpePart":null,"purl":"pkg:gem/globalid","purlType":"gem","versions":[{"text":"≥ 0.2.1, < 1.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.2.1, < 1.0.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"ruby3.2-rubygem-globalid&distro=openSUSE Tumbleweed","name":"ruby3.2-rubygem-globalid","label":"ruby3.2-rubygem-globalid&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/ruby3.2-rubygem-globalid&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.1.0-1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.0-1.3","eol":null,"hubHref":null},{"vendor":"opensuse","product":"rubygem-globalid&distro=openSUSE Leap 15.4","name":"rubygem-globalid","label":"rubygem-globalid&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rubygem-globalid&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 0.4.1-150000.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-150000.3.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"rubygem-globalid&distro=openSUSE Tumbleweed","name":"rubygem-globalid","label":"rubygem-globalid&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rubygem-globalid&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.1.0-1.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.2.1-1.5","noFixRecorded":false,"fixedIn":null},{"text":"< 1.2.1-1.7","noFixRecorded":false,"fixedIn":null},{"text":"< 1.2.1-1.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.0-1.1 | < 1.2.1-1.5 | < 1.2.1-1.7 | < 1.2.1-1.9","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","name":"rubygem-globalid","label":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP1","purlType":"rpm","versions":[{"text":"< 0.4.1-150000.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-150000.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","name":"rubygem-globalid","label":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP2","purlType":"rpm","versions":[{"text":"< 0.4.1-150000.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-150000.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","name":"rubygem-globalid","label":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP3","purlType":"rpm","versions":[{"text":"< 0.4.1-150000.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-150000.3.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","name":"rubygem-globalid","label":"rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rubygem-globalid&distro=SUSE Linux Enterprise High Availability Extension 15 SP4","purlType":"rpm","versions":[{"text":"< 0.4.1-150000.3.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.1-150000.3.3.1","eol":null,"hubHref":null},{"vendor":"rubyonrails","product":"globalid","name":"globalid","label":"globalid","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.2.1, < 1.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.2.1, < 1.0.1","eol":null,"hubHref":"/vendor/rubyonrails/globalid"}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127","label":"discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127","hostname":"discuss.rubyonrails.org","tags":["REPORT","WEB","Patch","Vendor Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230328-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20230328-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1207587","label":"bugzilla.suse.com/1207587","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22799","label":"www.suse.com/security/cve/CVE-2023-22799","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2023-22799","label":"ubuntu.com/security/CVE-2023-22799","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://github.com/rails/globalid/commit/3bc4349422e60f2235876a59dd415e98b072eb2b","label":"github.com/rails/globalid/commit/3bc4349422e60f2235876a59dd415e98b072eb2b","hostname":"github.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22799","label":"www.cve.org/CVERecord?id=CVE-2023-22799","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22799","label":"security-tracker.debian.org/tracker/CVE-2023-22799","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UOEH4YZV62ZWIQ47JFLR444WOOTIUDBI/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22799","label":"nvd.nist.gov/vuln/detail/CVE-2023-22799","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/rails/globalid/commit/4a75ecbfd73a8e92e32a1723b81a17e3136bd8fc","label":"github.com/rails/globalid/commit/4a75ecbfd73a8e92e32a1723b81a17e3136bd8fc","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/rails/globalid","label":"github.com/rails/globalid","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/rails/globalid/releases/tag/v1.0.1","label":"github.com/rails/globalid/releases/tag/v1.0.1","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/globalid/CVE-2023-22799.yml","label":"github.com/rubysec/ruby-advisory-db/blob/master/gems/globalid/CVE-2023-22799.yml","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["RHSA-2023:6818"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-02-09T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T10:20:30.834Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:49:55.088Z","stale":false,"partial":false}}