cve/2023/CVE-2023-22795.md

### [CVE-2023-22795](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22795)
![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Frails%2Frails&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service%20(CWE-400)&color=brighgreen)

### Description

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/bibin-paul-trustme/ruby_repo
- https://github.com/jasnow/585-652-ruby-advisory-db
- https://github.com/rubysec/ruby-advisory-db