Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-62864: Ring library can be slowed by crafted query strings
CVE-2026-62864 · published 5 days ago
Summary
Versions of the Ring web library before 1.15.5 that use the wrap-nested-params feature can be forced to do a lot of extra work when an attacker sends specially crafted parameter names. This can make the application respond very slowly or become unavailable. Upgrade Ring to version 1.15.5 or later to stop the problem.
Original advisory text
Ring's nested-params middleware has inefficient regular expression complexity
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
References
- https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142... Patch
- https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj Vendor Advisory
- https://github.com/ring-clojure/ring/tree/1.15.5 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62864... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-62864 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta