Every CVE Search/ Get API key

CVE-2023-31606

RedCloth Regular Expression Denial of Service issue

7.5 HighPublic exploitFix available

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.51%Up 1.5 points since Jun 7, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
CVE-2023-31606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
CVE List No score

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
CVE-2023-31606
Updated
2026-11-02
EUVDEUVD-2023-1866 No score

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
EUVD-2023-1866
Updated
2026-11-03
GitHub AdvisoriesGHSA-qcm3-vfq5-wfr2 7.5

RedCloth Regular Expression Denial of Service issue

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of RedCloth gem. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
GHSA-qcm3-vfq5-wfr2
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2023-31606 7.5

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
DEBIAN-CVE-2023-31606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-qcm3-vfq5-wfr2 7.5

RedCloth Regular Expression Denial of Service issue

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of RedCloth gem. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
GHSA-qcm3-vfq5-wfr2
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-31606 7.5

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
UBUNTU-CVE-2023-31606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV No score

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Record
CVE-2023-31606
Updated
2026-11-02
OSVMGASA-2023-0291 No score

Updated ruby-RedCloth packages fix a security vulnerability

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (CVE-2023-31606)

Record
MGASA-2023-0291
Updated
2026-11-02
OSVUSN-6358-1 No score

ruby-redcloth vulnerability

It was discovered that RedCloth incorrectly handled certain inputs during html sanitisation. An attacker could possibly use this issue to cause a denial of service.

Record
USN-6358-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
RedCloth
RubyGems
 before 4.3.3
4.3.3
ruby-redcloth
Debian:12
 All versions, plus listed versions
4.3.2-44.3.3-14.3.4-14.3.4-2
 None known
ruby-redcloth
Debian:13
 before 4.3.3-1
4.3.3-1
ruby-redcloth
Debian:14
 before 4.3.3-1
4.3.3-1
ruby-redcloth
Debian:10
 before 4.3.2-3+deb10u1, plus listed versions
4.3.2-3
4.3.2-3+deb10u1
RedCloth
RubyGems
 before 4.3.3, plus listed versions
3.0.03.0.13.0.23.0.33.0.4
Show 23 moreShow less
4.0.04.0.14.0.24.0.34.0.44.1.04.1.14.1.94.2.04.2.14.2.24.2.34.2.44.2.4.pre14.2.4.pre24.2.4.pre34.2.54.2.74.2.84.2.94.3.04.3.14.3.2
4.3.3
ruby-RedCloth
Mageia:8
 before 4.3.2-5.1.mga8
4.3.2-5.1.mga8
ruby-RedCloth
Mageia:9
 before 4.3.2-7.1.mga9
4.3.2-7.1.mga9
ruby-redcloth
Ubuntu:Pro:16.04:LTS
 before 4.2.9-5ubuntu0.1~esm1, plus listed versions
4.2.9-5build14.2.9-5build24.2.9-5build34.2.9-5build4
4.2.9-5ubuntu0.1~esm1
ruby-redcloth
Ubuntu:Pro:18.04:LTS
 before 4.3.2-3ubuntu0.1~esm1, plus listed versions
4.3.2-24.3.2-34.3.2-3build1
4.3.2-3ubuntu0.1~esm1
ruby-redcloth
Ubuntu:20.04:LTS
 before 4.3.2-3+deb10u1build0.20.04.1, plus listed versions
4.3.2-3build14.3.2-3build2
4.3.2-3+deb10u1build0.20.04.1
ruby-redcloth
Ubuntu:22.04:LTS
 before 4.3.2-4ubuntu0.22.04.1, plus listed versions
4.3.2-3build24.3.2-3build34.3.2-4
4.3.2-4ubuntu0.22.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmerbinr/CVE-2023-316062023-06-03

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-31606 is a high vulnerability (CVSS 7.5) in Promptworks Redcloth, published June 6, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in RedCloth 4.3.3.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open