Ring's nested-params middleware has inefficient regular expression complexity
Impact
Ring library versions prior to 1.15.5 have inefficient regular expression complexity in the `wrap-nested-params` middleware, allowing an attacker to cause a denial of service. The issue is fixed in version 1.15.5. Applications not using the middleware are not exposed.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
ring-clojure · GitHub_M
ring
1 range
ring-clojure · GitHub_M
ring
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.15.5
Other versions: unknown
Original source description
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, wrap-nested-params in the ring.middleware.nested-params namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. Ring-Defaults users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-62864View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.