CVE-2024-26142

CWE-1333CWE-400 — Uncontrolled Resource Consumption8 documents7 sources
Severity
7.5HIGH
EPSS
3.5%
top 12.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rubyonrails RailsRails Rails
Timeline
PublishedFeb 27
Latest updateMay 22

Description

Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDrubyonrails/rails7.1.0 — 7.1.3.1
▶CVEListV5rails/rails>= 7.1.0, < 7.1.3.1
▶RubyGemsactionpack7.1.0 — 7.1.3.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch↗2024-02-27
▶
OSV
CVE-2024-26142: Rails is a web-application framework↗2024-02-27
▶
OSV
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch↗2024-02-27
▶
CVEList
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch↗2024-02-27
▶

📋Vendor Advisories

2
Red Hat
rubygem-actionpack: Possible DoS vulnerability in Accept header↗2024-02-24
▶
Debian
CVE-2024-26142: rails - Rails is a web-application framework. Starting in version 7.1.0, there is a poss...↗2024
▶

💬Community

1
HackerOne
[CVE-2024-26142] ReDoS vulnerability in Accept header parsing in Action Dispatch↗2024-05-22
▶