QwikSec

Security Database

CVE

CWE

Training

CVE-2024-25126

Published: Feb 28, 2024

Modified: Feb 13, 2025

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Vendor	Product	Versions
rack	rack	affected `>= 3.0.0, < 3.0.9.1` affected `>= 0.4, < 2.2.8.1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx

x_refsource_CONFIRM

https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462

x_refsource_MISC

https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49

x_refsource_MISC

https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941

x_refsource_MISC

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml

x_refsource_MISC

https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html

https://security.netapp.com/advisory/ntap-20240510-0005/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.