PT-2024-7928 · Ruby On Rails+6 · Action Pack+6

Scyoon · Published 2024-10-15 · Updated 2025-11-25 · CVE-2024-41128

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Action Pack versions 3.1.0 through 6.1.7.8 Action Pack versions 7.0.0 through 7.0.8.4 Action Pack versions 7.1.0 through 7.1.4.0 Action Pack versions 7.2.0 through 7.2.1.0

Description The issue is related to a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For Action Pack versions 3.1.0 through 6.1.7.8, upgrade to version 6.1.7.9 or apply the relevant patch immediately. For Action Pack versions 7.0.0 through 7.0.8.4, upgrade to version 7.0.8.5 or apply the relevant patch immediately. For Action Pack versions 7.1.0 through 7.1.4.0, upgrade to version 7.1.4.1 or apply the relevant patch immediately. For Action Pack versions 7.2.0 through 7.2.1.0, upgrade to version 7.2.1.1 or apply the relevant patch immediately. As a temporary workaround, consider using Ruby 3.2, which has mitigations for this problem.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2025-3714

BDU:2024-09432

BIT-RAILS-2024-41128

CVE-2024-41128

DLA-4383-1

DSA-5881-1

GHSA-X76W-6VJR-8XGJ

OESA-2024-2411

OPENSUSE-SU-2024:14472-1

OPENSUSE-SU-2024:14479-1

OPENSUSE-SU-2025:15110-1

OPENSUSE-SU-2025:15124-1

USN-7290-1

Affected Products

Alt Linux

Action Pack

Debian

Linuxmint

Red Os

Ruby

Ubuntu

References · 53

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41128.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-41128.yml · Exploit
• https://osv.dev/vulnerability/BIT-rails-2024-41128 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41128 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15124-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5881-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41128 · Security Note
• https://ubuntu.com/security/CVE-2024-47887 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x76w-6vjr-8xgj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-41128 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-41128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15110-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-41128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14479-1 · Vendor Advisory