-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the regex pattern in the BooleanTypecaster's call method. The commit diff shows the fix replaces '+' quantifiers with possessive '++' in the regex to prevent backtracking. The issue #184 explicitly identifies this regex as the ReDoS vector, and the CWE-404 classification aligns with resource exhaustion via unoptimized regex processing. The function's role in processing user-controllable 'value' arguments makes it the clear entry point for exploitation.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| active_attr | rubygems | < 0.15.4 | 0.15.4 |
Ongoing coverage of React2Shell