CVE-2022-28738

Name of the Vulnerable Software and Affected Versions Ruby versions 3.0.0 through 3.0.3 Ruby versions 3.1.0 through 3.1.1

Description A double free was found in the Regexp compiler. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations. The issue is related to the implementation of the Regexp class and can lead to a denial of service using specially crafted Regexp objects.

Recommendations For Ruby versions 3.0.0 through 3.0.3, update to version 3.0.4 or later. For Ruby versions 3.1.0 through 3.1.1, update to version 3.1.2 or later. As a temporary workaround, consider restricting the creation of Regexp objects from untrusted user input until a patch is available.