Every CVE Search/ Get API key

CVE-2013-4287

RubyGems Regular Expression Denial of Service vulnerability

4.3 MediumFix available

CVE-2013-4287 is a medium vulnerability (CVSS 4.3) in Ruby-lang Ruby, published October 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.33%, the 88th percentile. Fixed in rubygems-update 1.8.23.1.

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Exploit likelihood

3.33%Up 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
CVE-2013-4287
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
CVE-2013-4287
Updated
2026-11-02
EUVDEUVD-2022-3399 No score

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
EUVD-2022-3399
Updated
2026-11-03
GitHub AdvisoriesGHSA-9j7m-rjqx-48vh No score

RubyGems Regular Expression Denial of Service vulnerability

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
GHSA-9j7m-rjqx-48vh
Weakness
CWE-400
Updated
2026-11-02
OSV No score

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
CVE-2013-4287
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4287 No score

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
DEBIAN-CVE-2013-4287
Updated
2026-11-02
OSVGHSA-9j7m-rjqx-48vh No score

RubyGems Regular Expression Denial of Service vulnerability

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Record
GHSA-9j7m-rjqx-48vh
Weakness
CWE-400
Updated
2026-11-02
OSVMGASA-2013-0297 No score

Updated ruby-RubyGems package fixes security vulnerabilies

Updated ruby-RubyGems package fixes security vulnerability:

RubyGems validates versions with a regular expression that is vulnerable to denial of service due to a backtracking regular expression. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption (CVE-2013-4287, CVE-2013-4363).

Record
MGASA-2013-0297
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rubygems-update
RubyGems
 before 1.8.23.1
1.8.23.1
rubygems-update
RubyGems
 1.8.24 up to 1.8.26
1.8.26
rubygems-update
RubyGems
 2.0.0 up to 2.0.8
2.0.8
rubygems-update
RubyGems
 2.1.0.rc.1 up to 2.1.0
2.1.0
rubygems
Debian:12
 before 3.2.0~rc.1-1
3.2.0~rc.1-1
rubygems
Debian:13
 before 3.2.0~rc.1-1
3.2.0~rc.1-1
rubygems
Debian:14
 before 3.2.0~rc.1-1
3.2.0~rc.1-1
rubygems-update
RubyGems
 before 1.8.23.1, plus listed versions
0.8.100.8.110.8.30.8.40.8.5
Show 45 moreShow less
0.8.60.8.80.9.00.9.10.9.20.9.30.9.40.9.51.0.01.0.11.1.01.1.11.2.01.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.4.01.4.11.4.21.5.01.5.21.5.31.6.01.6.11.6.21.7.01.7.11.7.21.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.181.8.19
1.8.23.1
rubygems-update
RubyGems
 1.8.24 up to 1.8.26, plus listed versions
1.8.25
1.8.26
rubygems-update
RubyGems
 2.0.0 up to 2.0.8, plus listed versions
2.0.22.0.32.0.42.0.52.0.62.0.7
2.0.8
Show 40 moreShow less
Affected packages
PackageAffectedFixed
rubygems-update
RubyGems
 2.1.0.rc.1 up to 2.1.0, plus listed versions
2.1.0.rc.2
2.1.0
ruby-RubyGems
Mageia:3
 before 1.8.27-1.mga3
1.8.27-1.mga3
ruby193-ruby
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-debuginfo
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-devel
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-doc
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-irb
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-libs
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-tcltk
Red Hat:rhel_software_collections:1::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-rubygem-bigdecimal
Red Hat:rhel_software_collections:1::el6
 before 0:1.1.0-40.el6
0:1.1.0-40.el6
ruby193-rubygem-io-console
Red Hat:rhel_software_collections:1::el6
 before 0:0.3-40.el6
0:0.3-40.el6
ruby193-rubygem-json
Red Hat:rhel_software_collections:1::el6
 before 0:1.5.5-40.el6
0:1.5.5-40.el6
ruby193-rubygem-minitest
Red Hat:rhel_software_collections:1::el6
 before 0:2.5.1-40.el6
0:2.5.1-40.el6
ruby193-rubygem-rake
Red Hat:rhel_software_collections:1::el6
 before 0:0.9.2.2-40.el6
0:0.9.2.2-40.el6
ruby193-rubygem-rdoc
Red Hat:rhel_software_collections:1::el6
 before 0:3.9.5-40.el6
0:3.9.5-40.el6
ruby193-rubygems
Red Hat:rhel_software_collections:1::el6
 before 0:1.8.23-40.el6
0:1.8.23-40.el6
ruby193-rubygems-devel
Red Hat:rhel_software_collections:1::el6
 before 0:1.8.23-40.el6
0:1.8.23-40.el6
rubygems
Red Hat:enterprise_linux:6::client
 before 0:1.3.7-4.el6_4
0:1.3.7-4.el6_4
rubygems
Red Hat:enterprise_linux:6::computenode
 before 0:1.3.7-4.el6_4
0:1.3.7-4.el6_4
rubygems
Red Hat:enterprise_linux:6::server
 before 0:1.3.7-4.el6_4
0:1.3.7-4.el6_4
rubygems
Red Hat:enterprise_linux:6::workstation
 before 0:1.3.7-4.el6_4
0:1.3.7-4.el6_4
ruby193-ruby
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-debuginfo
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-devel
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-doc
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-irb
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-libs
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-ruby-tcltk
Red Hat:openstack:3::el6
 before 0:1.9.3.448-40.el6
0:1.9.3.448-40.el6
ruby193-rubygem-bigdecimal
Red Hat:openstack:3::el6
 before 0:1.1.0-40.el6
0:1.1.0-40.el6
ruby193-rubygem-io-console
Red Hat:openstack:3::el6
 before 0:0.3-40.el6
0:0.3-40.el6
ruby193-rubygem-json
Red Hat:openstack:3::el6
 before 0:1.5.5-40.el6
0:1.5.5-40.el6
ruby193-rubygem-minitest
Red Hat:openstack:3::el6
 before 0:2.5.1-40.el6
0:2.5.1-40.el6
ruby193-rubygem-rake
Red Hat:openstack:3::el6
 before 0:0.9.2.2-40.el6
0:0.9.2.2-40.el6
ruby193-rubygems
Red Hat:openstack:3::el6
 before 0:1.8.24-9.el6ost
0:1.8.24-9.el6ost
ruby193-rubygems-devel
Red Hat:openstack:3::el6
 before 0:1.8.24-9.el6ost
0:1.8.24-9.el6ost
rubygems
Red Hat:enterprise_mrg:2:computenode:el6
 before 0:1.8.23.2-1.el6
0:1.8.23.2-1.el6
cumin
Red Hat:enterprise_mrg:2:server:el6
 before 0:0.1.5787-4.el6
0:0.1.5787-4.el6
rubygems
Red Hat:enterprise_mrg:2:server:el6
 before 0:1.8.23.2-1.el6
0:1.8.23.2-1.el6
rubygems
Red Hat:openshift:2.0::el6
 before 0:1.8.24-5.el6op
0:1.8.24-5.el6op
rubygems-devel
Red Hat:openshift:2.0::el6
 before 0:1.8.24-5.el6op
0:1.8.24-5.el6op

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 55 moreShow less
This page doesn't list everything

Left out here: 12 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open