CVE-2013-4363
RubyGems Regular Expression Denial of Service
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Exploit likelihood
What each source reports
NVD Score used
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
CVE-2013-4363- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
CVE-2013-4363- Updated
- 2026-11-02
EUVDEUVD-2022-3436 No score
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
EUVD-2022-3436- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qvm-2vhf-q649 No score
RubyGems Regular Expression Denial of Service
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
GHSA-9qvm-2vhf-q649- Updated
- 2026-11-02
OSV No score
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
CVE-2013-4363- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4363 No score
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
DEBIAN-CVE-2013-4363- Updated
- 2026-11-02
OSVGHSA-9qvm-2vhf-q649 No score
RubyGems Regular Expression Denial of Service
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
- Record
GHSA-9qvm-2vhf-q649- Updated
- 2026-11-02
OSVMGASA-2013-0297 No score
Updated ruby-RubyGems package fixes security vulnerabilies
Updated ruby-RubyGems package fixes security vulnerability:
RubyGems validates versions with a regular expression that is vulnerable to denial of service due to a backtracking regular expression. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption (CVE-2013-4287, CVE-2013-4363).
- Record
MGASA-2013-0297- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rubygems-updateRubyGems |
before 1.8.23.2 | 1.8.23.2 |
rubygems-updateRubyGems |
1.8.24 up to 1.8.27 | 1.8.27 |
rubygems-updateRubyGems |
2.0.0 up to 2.0.10 | 2.0.10 |
rubygems-updateRubyGems |
2.1.0 up to 2.1.5 | 2.1.5 |
rubygemsDebian:12 |
before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygemsDebian:13 |
before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygemsDebian:14 |
before 3.2.0~rc.1-1 | 3.2.0~rc.1-1 |
rubygems-updateRubyGems |
before 1.8.23.2, plus listed versions 0.8.100.8.110.8.30.8.40.8.5 Show 45 moreShow less0.8.60.8.80.9.00.9.10.9.20.9.30.9.40.9.51.0.01.0.11.1.01.1.11.2.01.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.4.01.4.11.4.21.5.01.5.21.5.31.6.01.6.11.6.21.7.01.7.11.7.21.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.181.8.19 |
1.8.23.2 |
rubygems-updateRubyGems |
1.8.24 up to 1.8.27, plus listed versions 1.8.251.8.26 |
1.8.27 |
rubygems-updateRubyGems |
2.0.0 up to 2.0.10, plus listed versions 2.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.9 |
2.0.10 |
rubygems-updateRubyGems |
2.1.0 up to 2.1.5, plus listed versions 2.1.12.1.22.1.32.1.4 |
2.1.5 |
ruby-RubyGemsMageia:3 From an advisory covering 2 CVEs |
before 1.8.27-1.mga3 | 1.8.27-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4363 is a medium vulnerability (CVSS 4.3) in Ruby-lang Ruby, published October 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in rubygems-update 1.8.23.2.
References
puppet.com/security/cve/cve-2013-4363
openwall.com/lists/oss-security/2013/09/18/8
blog.rubygems.org/2013/09/24/CVE-2013-4363.html
nvd.nist.gov/vuln/detail/CVE-2013-4363
Show 10 moreShow less
web.archive.org/web/20170331150441/https://puppet.com/security/cve/cve-2013-4363
github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2013-4363.yml
security-tracker.debian.org/tracker/CVE-2013-4363
advisories.mageia.org/MGASA-2013-0297.html
bugs.mageia.org/show_bug.cgi?id=11276
lists.fedoraproject.org/pipermail/package-announce/2013-September/115886.html
bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4287
Left out here: 12 versions. The JSON record has them.