Vulnerability advisory
CVE-2024-26142
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Also known as BIT-rails-2024-26142GHSA-jjhx-jhvp-74wq
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| d39db5d1891f7509cde2efc425c9d69bbb77e670 to before d73ed958dc91d6b8cbb0bef7b4cdcfc013bd876f | d73ed958dc91d6b8cbb0bef7b4cdcfc013bd876f |
| Not specified | b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 |
Also listed as affected (4)
| |
Description
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
References
- Webdiscuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26142.json ↗
- Advisorygithub.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq ↗
- Advisorygithub.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-26142 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20240503-0003/ ↗
- Fixgithub.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 ↗