Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m99x-hyvq-bue5
Vulnerability ID VCID-m99x-hyvq-bue5
Aliases CVE-2023-31606
GHSA-qcm3-vfq5-wfr2
Summary A denial of service vulnerability has been found in RedCloth.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31606.json
epss 0.00912 https://api.first.org/data/v1/epss?cve=CVE-2023-31606
epss 0.00912 https://api.first.org/data/v1/epss?cve=CVE-2023-31606
epss 0.00912 https://api.first.org/data/v1/epss?cve=CVE-2023-31606
epss 0.00912 https://api.first.org/data/v1/epss?cve=CVE-2023-31606
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qcm3-vfq5-wfr2
cvssv3 7.5 https://github.com/e23e/CVE-2023-31606#readme
cvssv3.1 7.5 https://github.com/e23e/CVE-2023-31606#readme
generic_textual HIGH https://github.com/e23e/CVE-2023-31606#readme
cvssv3.1 7.5 https://github.com/jgarber/redcloth
generic_textual HIGH https://github.com/jgarber/redcloth
cvssv3.1 7.5 https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
generic_textual HIGH https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
cvssv3.1 7.5 https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e
generic_textual HIGH https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e
cvssv3.1 7.5 https://github.com/jgarber/redcloth/issues/73
generic_textual HIGH https://github.com/jgarber/redcloth/issues/73
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-31606
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-31606
cvssv3.1 7.5 https://security.gentoo.org/glsa/202401-14
generic_textual HIGH https://security.gentoo.org/glsa/202401-14
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31606.json
https://api.first.org/data/v1/epss?cve=CVE-2023-31606
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31606
https://github.com/e23e/CVE-2023-31606#readme
https://github.com/jgarber/redcloth
https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e
https://github.com/jgarber/redcloth/issues/73
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml
https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
https://nvd.nist.gov/vuln/detail/CVE-2023-31606
1040488 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040488
2221255 https://bugzilla.redhat.com/show_bug.cgi?id=2221255
GHSA-qcm3-vfq5-wfr2 https://github.com/advisories/GHSA-qcm3-vfq5-wfr2
GLSA-202401-14 https://security.gentoo.org/glsa/202401-14
USN-6358-1 https://usn.ubuntu.com/6358-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-31606.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/e23e/CVE-2023-31606#readme
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jgarber/redcloth
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jgarber/redcloth/commit/8b1327688fef8e6617792054ef299d7bc74c0a1e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jgarber/redcloth/issues/73
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2023-31606.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2023/07/msg00002.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-31606
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202401-14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.76312
EPSS Score 0.00912
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:55:11.765757+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202401-14 38.6.0