Ruby 3.2.3 carries the URI parser security correction
The maintenance release updates the bundled URI gem to 0.12.2. Its denial-of-service fix illustrates why interpreter and library versions both matter to Ruby deployments.
A patch release of an interpreter can change the security of code that appears to be ordinary library use. Ruby 3.2.3 includes URI 0.12.2, carrying a correction for excessive parsing time on selected malformed URLs. The relevant dependency is therefore visible at two levels, the Ruby distribution and the URI gem loaded by an application.
The January 18 release announcement calls out that gem update alongside accumulated bug fixes. The associated CVE-2023-36617 advisory originally appeared in June last year. Today's maintenance release gives Ruby 3.2 users a distribution-level route to the corrected library.
I came to Ruby from Perl and still find its object model and readable method calls approachable. That convenience does not make parsing an untrusted string a trivial operation. A method that looks like a simple conversion can spend substantial time inside the implementation of its grammar.
Invalid input can consume parser time
The advisory identifies a regular-expression denial of service in the URI component through version 0.12.1. Invalid URLs containing particular characters can increase the time needed to convert strings into URI objects. Both rfc2396_parser.rb and rfc3986_parser.rb are named in the report.
The failure concerns work done while processing malformed input. A parser eventually rejecting a URL does not establish that rejecting it was cheap. If the application permits an external caller to supply those strings, the time spent rejecting them becomes part of the application's exposure to that caller.
The public notice does not provide a universal request duration or amplification factor. It also does not state that the issue permits code execution. The supported claim is narrower, a crafted invalid URL can make affected parsing take excessive time. That is enough to matter for services whose workers must process input supplied by other people.
The notice says this issue resulted from an incomplete fix for CVE-2023-28755. That history explains why an earlier URI security update did not settle the whole problem. Correcting one expensive matching case does not prove the absence of related expensive cases in the same grammar.
The library can be updated independently
The advisory recommends URI 0.12.2 for Ruby 3.2 and now explicitly lists upgrading to Ruby 3.2.3 as another option. It also describes updating the gem directly. These routes address the same library defect through different units of deployment.
For a Bundler-managed application, the advisory gives a dependency requirement. The entry makes the minimum corrected URI version explicit in the application's dependency declaration.
gem "uri", ">= 0.12.2"
That is a Gemfile requirement, not a Ruby expression that repairs a parser already loaded in a running process. The application still needs a resolved dependency set and a deployment using it. The practical distinction is between declaring an acceptable version and executing code from that version.
The advisory also lists URI 0.10.3 for compatibility with the older Ruby 3.0 series. That version should not be confused with a claim that only numerically larger gem versions can contain a fix. Maintained library lines can carry separate corrected releases. For this Ruby 3.2 post, the directly relevant version is the bundled 0.12.2 named by today's release announcement.
Maintenance covers interpreter behavior as well
The detailed Ruby 3.2.3 release record lists corrections beyond URI. These include failures in ObjectSpace::WeakMap around compaction, YJIT stack consistency and IO::Buffer behavior. Other entries concern parser leaks and platform build failures.
Those are distinct changes with distinct triggers. They should not be treated as additional consequences of the URI vulnerability. A maintenance release combines work across the interpreter and its distributed libraries, while a security advisory describes a particular defect and the versions that correct it.
That distinction also explains why the release is useful to applications remaining on Ruby 3.2. Obtaining these corrections does not require treating a patch update as a new language-feature adoption project. The release announcement presents accumulated repairs within that interpreter line.
Version identity needs the right granularity
Knowing that a process runs Ruby 3.2 is insufficient to identify whether this particular URI correction is present. The patch level and the application's library selection both carry relevant information. The release gives one known combination, Ruby 3.2.3 with its updated URI distribution.
My reservations about choosing Ruby for new systems do not diminish the need to maintain existing Ruby applications accurately. In this case, the maintenance update has a concrete security benefit that can be explained without a benchmark or an invented incident. The bundled parser moves to the corrected URI release, and applications managing URI through Bundler can state the same minimum version in their own dependency requirements.