7.5

CVE-2024-26146

Possible Denial of Service Vulnerability in Rack Header Parsing

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rack ≫ Rack SwPlatformruby Version >= 0.4 < 2.0.9.4
Rack ≫ Rack SwPlatformruby Version >= 2.1.0 < 2.1.4.4
Rack ≫ Rack SwPlatformruby Version >= 2.2.0 < 2.2.8.1
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
Mailing List
https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
Vendor Advisory
https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
Patch
https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
Patch
https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
Patch
https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
Patch
https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
Vendor Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240510-0006/
Third Party Advisory