CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-41817
High (7.5). EPSS 3.5% chance of exploitation in the next 30 days. Fixed in date 2.0.1, 3.0.2, 3.1.2.
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
Severity
- EPSS
- 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- opensuse:factory
- opensuse:leap
- redhat:enterprise_linux
- redhat:software_collections
- ruby-lang:date
- ruby-lang:ruby
- suse:linux_enterprise
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qg54-694p-wgpp | RubyGems | date | >=3.2.0 <3.2.1 | 3.2.1 |
| GHSA-qg54-694p-wgpp | RubyGems | date | >=3.1.0 <3.1.2 | 3.1.2 |
| GHSA-qg54-694p-wgpp | RubyGems | date | >=3.0.0 <3.0.2 | 3.0.2 |
| GHSA-qg54-694p-wgpp | RubyGems | date | <2.0.1 | 2.0.1 |
References
- https://hackerone.com/reports/1254844
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
- https://security.gentoo.org/glsa/202401-27
- https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/