{
  "cveId": "CVE-2022-23837",
  "url": "https://patchblox.com/security/cve/CVE-2022-23837",
  "summary": "CVE-2022-23837 is fixed in 2 products on 1 platform, first by ruby-sidekiq 5.0.4\u002Bdfsg-2ubuntu0.1~esm1, released January 21, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ruby-sidekiq: In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the g...",
  "description": "In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.",
  "published": "2022-01-21T13:15:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.05215,
  "epssPercentile": 0.92552,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:5498",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-5498",
      "released": "2022-07-05T13:55:16Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.4.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-23837",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23837",
      "released": "2022-01-21T21:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.4.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-23837",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23837",
      "released": "2022-01-21T21:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Debian 14",
      "fixedVersion": "6.4.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2022-23837",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23837",
      "released": "2022-01-21T21:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "5.0.4\u002Bdfsg-2ubuntu0.1~esm1",
      "fix": "ruby-sidekiq 5.0.4\u002Bdfsg-2ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-sidekiq-5.0.4-dfsg-2ubuntu0.1-esm1",
      "released": "2022-01-21T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "5.2.7\u002Bdfsg-1ubuntu0.1~esm1",
      "fix": "ruby-sidekiq 5.2.7\u002Bdfsg-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-sidekiq-5.2.7-dfsg-1ubuntu0.1-esm1",
      "released": "2022-01-21T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sidekiq",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "6.3.1\u002Bdfsg-1ubuntu0.1~esm1",
      "fix": "ruby-sidekiq 6.3.1\u002Bdfsg-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-sidekiq-6.3.1-dfsg-1ubuntu0.1-esm1",
      "released": "2022-01-21T13:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}