Ring
Monthly
Regular-expression denial of service in Ring's nested-params middleware lets unauthenticated remote attackers stall request handling by supplying a crafted parameter name in the query string or request body. Ring 1.15.4 and below are affected, and Ring-Defaults deployments are exposed out of the box because the nested-params middleware is enabled by default; applications that do not install the middleware never reach the vulnerable parsing path. The base 7.5 CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects availability-only impact, and no public exploit has been identified at time of analysis.
Regular-expression denial of service in Ring's nested-params middleware lets unauthenticated remote attackers stall request handling by supplying a crafted parameter name in the query string or request body. Ring 1.15.4 and below are affected, and Ring-Defaults deployments are exposed out of the box because the nested-params middleware is enabled by default; applications that do not install the middleware never reach the vulnerable parsing path. The base 7.5 CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects availability-only impact, and no public exploit has been identified at time of analysis.