CVE-2024-25126 — Regex Denial of Service in Rack

CWE-1333 — Regex Denial of Service13 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 41.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
RackDebian Ruby-rackDebian Linux
Timeline
PublishedFeb 29
Latest updateSep 26

Description

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/ruby-rack< ruby-rack 2.2.6.4-1+deb12u1 (bookworm)
▶NVDrack/rack0.4 — 2.2.8.1+1
▶RubyGemsrack/rack3.0.0 — 3.0.9.1+1
▶CVEListV5rack/rack>= 0.4, < 2.2.8.1, >= 3.0.0, < 3.0.9.1+1

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
ruby-rack vulnerabilities↗2024-09-26
▶
OSV
ruby-rack vulnerabilities↗2024-08-19
▶
OSV
ruby-rack vulnerabilities↗2024-06-17
▶
OSV
CVE-2024-25126: Rack is a modular Ruby web server interface↗2024-02-29
▶
GHSA
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)↗2024-02-28
▶

📋Vendor Advisories

5
Ubuntu
Rack vulnerabilities↗2024-09-26
▶
Ubuntu
Rack vulnerabilities↗2024-08-19
▶
Ubuntu
Rack vulnerabilities↗2024-06-17
▶
Red Hat
rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing↗2024-02-22
▶
Debian
CVE-2024-25126: ruby-rack - Rack is a modular Ruby web server interface. Carefully crafted content type head...↗2024
▶

💬Community

1
HackerOne
[CVE-2024-25126] Denial of Service Vulnerability in Rack Content-Type Parsing↗2024-05-22
▶