CVE-2026-62864

HighCVSS 7.5

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Ring before version 1.15.5 has a vulnerability in the wrap-nested-params middleware, which uses a backtracking regular expression to match parameter names. An attacker can craft a parameter name that causes quadratic CPU consumption (O(n^2)), leading to denial of service. Ring-Defaults users are also exposed because the middleware is enabled by default.

Risk Assessment

A remote attacker can exhaust application CPU resources through requests with long parameter names, causing denial of service. This affects applications using the middleware.

Recommendation

Update Ring to version 1.15.5 or later. If possible, disable the nested-params middleware if not needed.

Other vulnerabilities in Ring

CVE-2025-4432Medium
A flaw in Rust's Ring package causes a panic when overflow checking is enabled. In the QUIC protocol, an attacker can trigger this panic by sending a specially crafted packet. The issue occurs approximately once every 2^32 packets.

Original NVD description (English source)

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS