Vulnerability in Ring-Clojure Ring
CVE-2026-62864
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Ring-Clojure Ring — versions < 1.15.5
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-62864?
- CVE-2026-62864 is a high-severity vulnerability in Ring-Clojure Ring, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2026-10-30.
- How severe is CVE-2026-62864?
- High severity. CVSS v3 base score is 7.5 out of 10.