CVE-2022-28738.yml

---
engine: ruby
cve: 2022-28738
url: https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/
title: Double free in Regexp compilation
date: 2022-04-12
description: |
  A double-free vulnerability is discovered in Regexp compilation. This vulnerability has been assigned the CVE identifier CVE-2022-28738. We strongly recommend upgrading Ruby.

  Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.

  Please update Ruby to 3.0.4, or 3.1.2.
patched_versions:
  - "~> 3.0.4"
  - ">= 3.1.2"
unaffected_versions:
  - "~> 2.6.0"
  - "~> 2.7.0"