CVE-2026-62864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62864", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T21:10:50.032Z", "datePublished": "2026-10-30T20:34:42.963Z", "dateUpdated": "2026-11-02T15:05:18.669Z"}, "containers": {"cna": {"title": "Ring's nested-params middleware has inefficient regular expression complexity", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj"}, {"name": "https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e", "tags": ["x_refsource_MISC"], "url": "https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e"}, {"name": "https://github.com/ring-clojure/ring/tree/1.15.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/ring-clojure/ring/tree/1.15.5"}], "affected": [{"vendor": "ring-clojure", "product": "ring", "versions": [{"version": "< 1.15.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T20:34:42.963Z"}, "descriptions": [{"lang": "en", "value": "Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5."}], "source": {"advisory": "GHSA-q2j3-fc6x-78jj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T15:04:29.414692Z", "id": "CVE-2026-62864", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:05:18.669Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T15:04:29.414692Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T15:04:35.805Z"}}], "cna": {"title": "Ring's nested-params middleware has inefficient regular expression complexity", "source": {"advisory": "GHSA-q2j3-fc6x-78jj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ring-clojure", "product": "ring", "versions": [{"status": "affected", "version": "< 1.15.5"}]}], "references": [{"url": "https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj", "name": "https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e", "name": "https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ring-clojure/ring/tree/1.15.5", "name": "https://github.com/ring-clojure/ring/tree/1.15.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T20:34:42.963Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62864", "state": "PUBLISHED", "dateUpdated": "2026-11-02T15:05:18.669Z", "dateReserved": "2026-07-14T21:10:50.032Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-30T20:34:42.963Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ring", "vendor": "ring-clojure", "versions": [{"status": "affected", "version": "< 1.15.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5."}], "id": "CVE-2026-62864", "lastModified": "2026-11-02T19:34:23.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62864", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T15:04:29.414692Z", "version": "2.0.3"}}]}, "published": "2026-10-30T21:17:14.693", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e"}, {"source": "security-advisories@github.com", "url": "https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj"}, {"source": "security-advisories@github.com", "url": "https://github.com/ring-clojure/ring/tree/1.15.5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ring/ring-core: Ring: Denial of Service via regular expression backtracking in wrap-nested-params", "id": "2564318", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564318"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.", "A flaw was found in Ring. A remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with specially crafted parameter names to applications using the wrap-nested-params middleware. The middleware relies on an inefficient regular expression that experiences excessive backtracking when parsing complex input. Processing these malicious requests consumes disproportionate server processor resources, rendering the affected application unresponsive to legitimate users."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-62864", "package_state": [{"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-server", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-30T20:34:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62864\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62864\nhttps://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e\nhttps://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj\nhttps://github.com/ring-clojure/ring/tree/1.15.5"], "statement": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU resources and induce a denial of service without requiring credentials. The issue stems from algorithmic complexity and backtracking during the evaluation of nested HTTP parameter names. Red Hat products, including Red Hat Satellite, are not affected as the vulnerable middleware is not present in supported environments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.15.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ring", "source": "cna", "vendor": "ring-clojure"}, "product": "ring", "vendor": "ring-clojure"}], "created": "2026-10-30T22:48:05.196560+00:00", "updated": "2026-10-30T23:30:15.708684+00:00", "vendors": ["ring-clojure", "ring-clojure$PRODUCT$ring"]}