CVE-2023-22796

What it actually does

This is a regular-expression denial-of-service vulnerability in the Active Support `underscore` method. When a specially crafted string is passed to `underscore`, the underlying Ruby regular expression engine can perform catastrophic backtracking, consuming excessive CPU and memory. Because the CVSS vector indicates network reachability, low complexity, no privileges, and no user interaction, applications that pass attacker-controlled input into affected Active Support code paths may be remotely forced into high resource consumption and service degradation. The impact is availability-only; it does not directly provide code execution, data disclosure, or data modification.

Why it matters to the business

An affected application can be made slow or unavailable by crafted input, potentially causing failed transactions, degraded user experience, increased infrastructure costs from resource exhaustion, and operational incidents requiring scaling or restarts. Although this issue is not listed in CISA KEV and has low EPSS, it is old enough that mature remediation should already be in place, and internet-facing Ruby on Rails or Active Support services should treat lingering exposure as technical debt with availability risk.

How an attack unfolds

An attacker first identifies an application endpoint or background processing path that accepts attacker-controlled strings and eventually calls Active Support's `underscore` method on that input, either directly or through framework/application logic. The attacker then submits a deliberately malformed or unusually structured string designed to trigger catastrophic backtracking in the vulnerable regular expression. The Ruby process spends disproportionate time evaluating the expression, driving CPU utilization high and potentially increasing memory pressure. By sending one or more such requests, the attacker can tie up application workers, exhaust process resources, increase latency, and cause denial of service. No authentication or user interaction is required if the vulnerable input path is externally reachable.

How to fix it

Upgrade Active Support/Rails to a fixed release. For the affected branches described, use Active Support 6.1.7.1 or later for the 6.1 line, and Active Support 7.0.4.1 or later for the 7.0 line. If Active Support is pulled in through Rails, upgrade the Rails dependency set to a release that includes the fixed Active Support version. Run dependency resolution carefully so `Gemfile.lock` no longer pins a vulnerable `activesupport` version. If immediate upgrade is not possible, reduce exposure by rejecting or bounding excessively long untrusted strings before they reach normalization routines, applying request/body size limits, rate limiting unauthenticated endpoints, adding worker timeouts, and isolating expensive background processing from user-facing request workers. Mitigations reduce exploitability but should not replace upgrading.

How to confirm the fix worked

Confirm the deployed dependency inventory shows `activesupport` at 6.1.7.1 or later, 7.0.4.1 or later, or another non-vulnerable supported release. Review `Gemfile.lock`, software composition analysis results, container image SBOMs, and deployed artifact manifests rather than only source manifests. Restart or redeploy application processes after upgrading so the fixed gem is loaded. Validate that application endpoints handling untrusted strings enforce length limits and that request rate limits and worker timeouts are active. In staging, use safe performance tests with representative long malformed strings to confirm requests are rejected or handled quickly and do not cause sustained CPU spikes.

Typical attack path

1. Identify a Ruby/Rails application or service using a vulnerable Active Support version before 6.1.7.1 or before 7.0.4.1.
2. Find an externally reachable parameter, API field, header, route segment, uploaded metadata field, or job input that is normalized or transformed using `underscore`.
3. Send a specially crafted long or complex string that causes the vulnerable regular expression to backtrack catastrophically.
4. Repeat requests or submit concurrent payloads to consume application worker CPU and memory.
5. Cause elevated latency, worker exhaustion, failed health checks, process restarts, or service unavailability.

How to detect it

There is no reliable public, CVE-specific payload indicator for confirmed exploitation because the malicious string depends on how an application passes input to `underscore`. To investigate possible prior exploitation, review web access logs, API gateway logs, reverse proxy logs, WAF events, application logs, APM traces, and infrastructure metrics for periods of sudden Ruby process CPU saturation, memory growth, request latency, 499/500/502/503/504 errors, worker timeouts, or restarts that correlate with requests containing unusually long, repetitive, or malformed string parameters. Focus on unauthenticated endpoints and requests with oversized path segments, query parameters, JSON fields, form fields, headers, or metadata that are later normalized by application code. In Ruby/Rails telemetry, look for repeated slow requests where application time is high but database and external service time are low. Correlate suspicious request source IPs, user agents, and payload shapes across logs. Also review dependency history to determine whether the vulnerable Active Support version was deployed during the suspicious time window.

What your security team should do

• Inventory Ruby applications, Rails services, containers, and background workers for vulnerable `activesupport` versions.
• Prioritize internet-facing, unauthenticated, API-heavy, or multi-tenant services where attacker-controlled strings may reach Active Support transformations.
• Upgrade to Active Support 6.1.7.1 or later, 7.0.4.1 or later, or a current supported Rails release that includes the fix.
• Verify deployed artifacts and lockfiles after remediation; do not rely solely on package manifest intent.
• Add application-layer input length validation and rate limiting on unauthenticated endpoints as defense in depth.
• Monitor for unexplained Ruby worker CPU saturation, memory pressure, request timeouts, 5xx spikes, and repeated long malformed input patterns.
• Ensure autoscaling, process supervision, and health checks are configured to recover from worker exhaustion without cascading failure.