🎯 New Report #3542546: Server-side ReDoS via user-controlled regex in OIDC Access Policy
🔺Severity: null
👽 Reporter: 6b jjj
⭐️ Reputation: 542
🛠 State: resolved
💼 Team: RubyGems
💵 Bounty: null
🕐 Submitted: 2026-02-06
⏰ Disclosed: 2026-03-26 09:31:22
📝 Summary: The OIDC Access Policy implementation evaluated user-supplied regular expressions against JWT claim values using Ruby's Regexp engine without any timeout or complexity validation. The vulnerable code path was Regexp.new(value).match?(claim value), where value was fully user-controlled and claim value was derived from JWT claims. Malicious regular expressions with catastrophic backtracking characteristics could be supplied, causing the server to spend an excessive amount of CPU time evaluating a single request.
📂 Report JSON File: 3542546
@hackeronereports