{"id":"CVE-2026-62864","kind":"vulnerability","aliases":["CVE-2026-62864"],"related":[],"title":"Ring Clojure library: crafted parameter names cause regex denial of service","description":"Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.","summary":"Ring is a Clojure library for web applications; before 1.15.5, its nested-params middleware uses a backtracking regular expression on request parameter names. An attacker can send a crafted parameter name that makes the server spend quadratic time matching it, causing a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clojure","package","ring","web-apps"],"not_affected_if":["no-nested-params-middleware","ring-version-1.15.5-or-later"],"how_to_check":"- Check the Ring version in the project's dependency file (for example `project.clj` or `deps.edn`) and confirm whether it is below `1.15.5`.\n- Search the code for `wrap-nested-params` or `ring.middleware.nested-params`, including use through `Ring-Defaults`, since nested-params is enabled by default there.","fix":"- Ring: upgrade to `1.15.5`","status":"open","published_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:43+00:00","updated_at":"2026-10-30T21:26:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- Ring: upgrade to `1.15.5`","reach":"internet","title":"Ring Clojure library: crafted parameter names cause regex denial of service","impact":"low","summary":"Ring is a Clojure library for web applications; before 1.15.5, its nested-params middleware uses a backtracking regular expression on request parameter names. An attacker can send a crafted parameter name that makes the server spend quadratic time matching it, causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["clojure","ring","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server becomes slow or unresponsive from crafted parameter names","analyst_note":"","how_to_check":"- Check the Ring version in the project's dependency file (for example `project.clj` or `deps.edn`) and confirm whether it is below `1.15.5`.\n- Search the code for `wrap-nested-params` or `ring.middleware.nested-params`, including use through `Ring-Defaults`, since nested-params is enabled by default there.","plain_action":"","needs_analyst":false,"not_affected_if":["no-nested-params-middleware","ring-version-1.15.5-or-later"],"who_is_affected":"Clojure web applications that use Ring and enable the nested-params middleware are exposed, including anything using Ring-Defaults because it turns nested-params on by default. Applications that do not include the middleware do not expose this parsing path, so they can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4239,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62864':14A,17A '1.15.5':33B,88C,173C '2':127C 'also':147C 'app':23B 'applic':31B,75C,138C,157C 'attack':49B,116C 'backtrack':41B,100C 'bodi':114C 'caus':7A,65B,130C 'clojur':2A,18B,27B,73C 'craft':4A,53B,118C 'cve':12A,15A 'default':144C,156C 'denial':9A,67B,134C 'drive':123C 'enabl':154C 'expos':148C,163C 'express':43B,102C,133C 'fix':170C 'http':112C 'inspir':77C 'issu':168C 'librari':3A,28B,76C 'make':57B 'match':63B,104C,128C 'middlewar':38B,141C,160C 'n':126C 'name':6A,47B,55B,106C,121C 'namespac':97C 'nest':36B,91C,151C 'nested-param':35B,150C 'o':125C 'omit':158C 'packag':19B 'param':37B,92C,96C,152C 'paramet':5A,46B,54B,105C,120C 'pars':165C 'path':166C 'prior':86C 'python':79C 'quadrat':61B,124C 'queri':109C 'rack':85C 'regex':8A 'regular':42B,101C,132C 'regular-express':131C 'request':45B,113C 'ring':1A,20B,24B,70C,143C 'ring-default':142C 'ring.middleware.nested':95C 'rubi':83C 'send':51B 'server':59B 'servic':11A,69B,136C 'spend':60B 'string':110C 'time':62B 'url':108C 'use':39B,98C,139C 'user':145C 'version':172C 'web':22B,30B,74C 'web-app':21B 'work':129C 'wrap':90C 'wrap-nested-param':89C 'wsgi':81C","nicknames":[],"mitigations":[],"who_affected":"Clojure web applications that use Ring and enable the nested-params middleware are exposed, including anything using Ring-Defaults because it turns nested-params on by default. Applications that do not include the middleware do not expose this parsing path, so they can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62864","severity":null,"published_at":"2026-10-30T21:17:14+00:00","modified_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}