# CVE-2023-28755: ReDoS vulnerability in URI

Ruby's URI parser regex backtracks catastrophically on invalid URLs containing two '#' characters, causing ReDoS denial of service.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: dee-see
- Disclosed: 2023-04-26
- CVE: CVE-2023-28755
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1944515
- Library page: https://bugbountylibrary.com/r/h1%3A1944515
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:fuzzing technique:source-review vuln:dos

**Target:** URI parsing library (uri gem)
**Root cause:** The URI parser's regex for validating URLs backtracks exponentially when the input contains two '#' characters, since it correctly rejects the string but does so via catastrophic backtracking.
**Steps:**
1. Run `URI('https://example.com/dir/' + 'a'*n + '/##.jpg')` in Ruby 3.1.0
2. Observe parse time roughly quintuples as n doubles (1s at 50k, 122s at 400k)
3. Send such a long invalid URL in a request body to trigger DoS
**How found:** Found accidentally while fuzzing for something else; noticed the parser correctly rejects double-'#' URLs but execution time grows much faster than string length.
**Exploitation:** Attacker supplies a long user-controlled string containing two '#' characters to any endpoint that parses it as a URI, causing the server to hang for minutes per request.
**Insight:** ReDoS can hide in validation regexes that correctly reject input but backtrack catastrophically; fuzz invalid inputs with repeated special characters and benchmark scaling, not just correctness.