PT-2024-28440 · Rack · Rack

Dwisiswant0 · Published 2024-02-28 · Updated 2025-10-10 · CVE-2024-39316

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rack versions 3.1.0 through 3.1.4 Rack versions prior to 2.0.9.4 Rack versions prior to 2.1.4.4 Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1

Description A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Rack::Request::Helpers module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted Accept-Encoding or Accept-Language headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS).

Recommendations For Rack versions 3.1.0 through 3.1.4, upgrade to version 3.1.5 to receive the fix. For Rack versions prior to 2.0.9.4, apply the 2-0-header-redos.patch or upgrade to version 2.0.9.4. For Rack versions prior to 2.1.4.4, apply the 2-1-header-redos.patch or upgrade to version 2.1.4.4. For Rack versions prior to 2.2.8.1, apply the 2-2-header-redos.patch or upgrade to version 2.2.8.1. For Rack versions prior to 3.0.9.1, apply the 3-0-header-redos.patch or upgrade to version 3.0.9.1. As a temporary workaround, consider restricting access to the Rack::Request::Helpers module until a patch is available. Avoid using the Accept-Encoding and Accept-Language headers in the affected API endpoints until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-39316

GHSA-54RR-7FVW-6X8F

GHSA-CJ83-2WW7-MVQ7

Affected Products

Rack

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39316.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml · Exploit
• https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058 · Patch
• https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39316 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-39316 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39316 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cj83-2ww7-mvq7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26146 · Security Note
• https://osv.dev/vulnerability/GHSA-54rr-7fvw-6x8f · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39316 · Vendor Advisory
• https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716 · Note
• https://github.com/rack/rack · Note