GHSA-q2j3-fc6x-78jj: Ring's nested-params middleware has inefficient regular expression complexity
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, wrap-nested-params in the ring.middleware.nested-params namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. Ring-Defaults users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ringto a version that resolves this vulnerability.Fixed in 1.15.5
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Ring before 1.15.5 are exposed if they use the wrap-nested-params middleware. Ring-Defaults users are exposed because nested-params is enabled by default; applications that omit this middleware do not expose the affected parsing path.
What does an attacker need to exploit it?
An attacker can send a crafted parameter name through a URL query string or HTTP request body. No privileges or user interaction are required.
What is the practical impact of successful exploitation?
The crafted parameter name can cause quadratic regular-expression matching work, resulting in regular-expression denial of service. The reported impact is availability loss rather than confidentiality or integrity impact.
How can this be remediated or mitigated?
Upgrade Ring to version 1.15.5, which fixes the issue. If an immediate upgrade is not possible, omitting wrap-nested-params removes the affected parsing path.