Live › vulnerability › CVE-2026-62864
Ring is a Clojure library for web applications; before 1.15.5, its nested-params middleware uses a backtracking regular expression on request parameter names. An attacker can send a crafted parameter name that makes the server spend quadratic time matching it, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Clojure web applications that use Ring and enable the nested-params middleware are exposed, including anything using Ring-Defaults because it turns nested-params on by default. Applications that do not include the middleware do not expose this parsing path, so they can skip it.
No product ranges from the sources yet.
project.clj or deps.edn) and confirm whether it is below 1.15.5.wrap-nested-params or ring.middleware.nested-params, including use through Ring-Defaults, since nested-params is enabled by default there.1.15.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, wrap-nested-params in the ring.middleware.nested-params namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. Ring-Defaults users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-62864")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.