cve/2023/CVE-2023-22796.md

### [CVE-2023-22796](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22796)
![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Frails%2Frails&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service%20(CWE-400)&color=brighgreen)

### Description

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/holmes-py/reports-summary