CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)

2024-02-2823:28:07

CWE-1333

GitHub_M

www.cve.org

rack modular ruby web server interface

denial of service vulnerability

content type parsing

patched

cve-2024-25126

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

CNA Affected

[
  {
    "vendor": "rack",
    "product": "rack",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.0.9.1",
        "status": "affected"
      },
      {
        "version": ">= 0.4, < 2.2.8.1",
        "status": "affected"
      }
    ]
  }
]