CVE-2024-39316
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
In short
A flaw in Rack's HTTP header parsing allows attackers to send specially crafted Accept headers that force the server to use excessive computing power, temporarily making it unresponsive. This is a type of attack called ReDoS (Regular Expression Denial of Service).
Technical detail
CVE-2024-39316 is a ReDoS vulnerability in Rack 3.1.0-3.1.4 within the Rack::Request::Helpers module's Accept header parsing logic. An attacker can exploit this by sending malicious Accept-Encoding or Accept-Language headers that cause pathological regex backtracking, resulting in CPU exhaustion and service degradation. Upgrade to Rack 3.1.5 or later to resolve the issue.
Summary generated and translated by AI from the official description.
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
rack · rackWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →