CVE-2021-41817: Debian Linux

High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days.

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Opensuse Factory: affected versions not specified
• Opensuse Leap: version 15.2 only
• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only
• Red Hat Software Collections: affected versions not specified
• Ruby-Lang Date: before 2.0.1 (fixed in 2.0.1); from 3.0.0, before 3.0.2 (fixed in 3.0.2); from 3.1.0, before 3.1.2 (fixed in 3.1.2); version 3.2.0 only
• Ruby-Lang Ruby: from 2.6.0, before 2.6.9 (fixed in 2.6.9); from 2.7.0, before 2.7.5 (fixed in 2.7.5); from 3.0.0, before 3.0.3 (fixed in 3.0.3)
• Suse Linux Enterprise: version 12.0 only; version 15.0 only

Published 2022-01-01. Last modified 2026-06-17.