Denial of service in sidekiq

HIGH 7.5CVE-2022-23837 · GHSA-jrfj-98qg-qjgv · Published 21/01/2022 · updated 17/06/2026

In short

CVE-2022-23837 is a HIGH (CVSS 7.5) vulnerability affecting sidekiq, sidekiq (contribsys).
Chance of exploitation in the next 30 days (EPSS): 5.2%, higher than 92.5% of all vulnerabilities.
Fix: update to 6.4.0, 5.2.10 or later.

Package	Affected versions	Patched versions
sidekiq RubyGems	`≥ 6.0.0, < 6.4.0< 5.2.10`	`6.4.05.2.10`
sidekiq contribsys	`≥ 6.0.0, < 6.4.0< 5.2.10`	`6.4.05.2.10`

Description

In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

NVD description

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

References

nvd.nist.gov/vuln/detail/CVE-2022-23837 · ADVISORY
rubysec/ruby-advisory-db#495 · WEB
mperham/sidekiq commit 7785ac1 · WEB
TUTUMSPACE/exploits · WEB
mperham/sidekiq · PACKAGE
lists.debian.org/debian-lts-announce/2022/03/msg00015.html · WEB
lists.debian.org/debian-lts-announce/2023/03/msg00011.html

More vulnerabilities in sidekiq

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sidekiq

RubyGems

≥ 6.0.0, < 6.4.0< 5.2.10

6.4.05.2.10

sidekiq

contribsys

≥ 6.0.0, < 6.4.0< 5.2.10

6.4.05.2.10

Description

NVD description

More vulnerabilities in sidekiq

See all →