CVE-2024-39316 (GCVE-0-2024-39316)

Vulnerability from cvelistv5 – Published: 2024-07-02 15:57 – Updated: 2024-08-02 04:19
VLAI?
Summary
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
Impacted products
Vendor Product Version
rack rack Affected: >= 3.1.0, < 3.1.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-03T13:50:23.901915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T20:09:58.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:19:20.629Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7"
          },
          {
            "name": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f"
          },
          {
            "name": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rack",
          "vendor": "rack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.1.0, \u003c 3.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-02T15:57:39.107Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7"
        },
        {
          "name": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f"
        },
        {
          "name": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058"
        }
      ],
      "source": {
        "advisory": "GHSA-cj83-2ww7-mvq7",
        "discovery": "UNKNOWN"
      },
      "title": "Rack ReDoS Vulnerability in HTTP Accept Headers Parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39316",
    "datePublished": "2024-07-02T15:57:39.107Z",
    "dateReserved": "2024-06-21T18:15:22.261Z",
    "dateUpdated": "2024-08-02T04:19:20.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.\"}, {\"lang\": \"es\", \"value\": \"Rack es una interfaz modular de servidor web Ruby. A partir de la versi\\u00f3n 3.1.0 y antes de la versi\\u00f3n 3.1.5, existe una vulnerabilidad de denegaci\\u00f3n de servicio de expresi\\u00f3n regular (ReDoS) en el m\\u00f3dulo `Rack::Request::Helpers` al analizar los encabezados de aceptaci\\u00f3n HTTP. Esta vulnerabilidad puede ser aprovechada por un atacante que env\\u00eda encabezados \\\"Accept-Encoding\\\" o \\\"Accept-Language\\\" especialmente manipulados, lo que hace que el servidor dedique demasiado tiempo a procesar la solicitud y provoque una denegaci\\u00f3n de servicio (DoS). La soluci\\u00f3n para CVE-2024-26146 no se aplic\\u00f3 a la rama principal y, por lo tanto, aunque el problema se solucion\\u00f3 para la serie de versiones Rack v3.0, no se solucion\\u00f3 en la serie de versiones v3.1 hasta la v3.1.5. Los usuarios de versiones de la rama 3.1 deben actualizar a la versi\\u00f3n 3.1.5 para recibir la soluci\\u00f3n.\"}]",
      "id": "CVE-2024-39316",
      "lastModified": "2024-11-21T09:27:26.727",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-02T16:15:04.753",
      "references": "[{\"url\": \"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1333\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39316\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-02T16:15:04.753\",\"lastModified\":\"2025-10-10T16:36:05.200\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.\"},{\"lang\":\"es\",\"value\":\"Rack es una interfaz modular de servidor web Ruby. A partir de la versi\u00f3n 3.1.0 y antes de la versi\u00f3n 3.1.5, existe una vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) en el m\u00f3dulo `Rack::Request::Helpers` al analizar los encabezados de aceptaci\u00f3n HTTP. Esta vulnerabilidad puede ser aprovechada por un atacante que env\u00eda encabezados \\\"Accept-Encoding\\\" o \\\"Accept-Language\\\" especialmente manipulados, lo que hace que el servidor dedique demasiado tiempo a procesar la solicitud y provoque una denegaci\u00f3n de servicio (DoS). La soluci\u00f3n para CVE-2024-26146 no se aplic\u00f3 a la rama principal y, por lo tanto, aunque el problema se solucion\u00f3 para la serie de versiones Rack v3.0, no se solucion\u00f3 en la serie de versiones v3.1 hasta la v3.1.5. Los usuarios de versiones de la rama 3.1 deben actualizar a la versi\u00f3n 3.1.5 para recibir la soluci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndExcluding\":\"3.1.5\",\"matchCriteriaId\":\"FD9FC600-59C1-4363-BA89-3C946E729C90\"}]}]}],\"references\":[{\"url\":\"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39316\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-03T13:50:23.901915Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-03T20:09:55.550Z\"}}], \"cna\": {\"title\": \"Rack ReDoS Vulnerability in HTTP Accept Headers Parsing\", \"source\": {\"advisory\": \"GHSA-cj83-2ww7-mvq7\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"rack\", \"product\": \"rack\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.1.0, \u003c 3.1.5\"}]}], \"references\": [{\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\", \"name\": \"https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\", \"name\": \"https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\", \"name\": \"https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-02T15:57:39.107Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39316\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-03T20:09:58.349Z\", \"dateReserved\": \"2024-06-21T18:15:22.261Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-02T15:57:39.107Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.