Skip to content
OpenAdvisories
High USN-6358-1 1 CVE

ruby-redcloth vulnerability

Published Sep 12, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that RedCloth incorrectly handled certain inputs during
html sanitisation. An attacker could possibly use this issue to cause a
denial of service.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby-redcloth 4.3.2-3+deb10u1build0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS ruby-redcloth 4.3.2-4ubuntu0.22.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-redcloth 4.2.9-5ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-redcloth 4.3.2-3ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2023-31606 Public exploit

    RedCloth Regular Expression Denial of Service issue

    A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

    RedCloth ruby-redcloth ruby-redcloth Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2023-31606