Lucene search

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

🗓️ 28 Feb 2024 22:26:57Reported by GitHub Advisory DatabaseType

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial) - 50K blank characters as a prefix can lead to server takeove

Reporter	Title	Published	Views	Family All 88
Cvelist	CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)	28 Feb 202423:28	–	cvelist
RedhatCVE	CVE-2024-25126	23 Feb 202403:01	–	redhatcve
Debian CVE	CVE-2024-25126	29 Feb 202400:15	–	debiancve
CVE	CVE-2024-25126	29 Feb 202400:15	–	cve
OSV	CGA-x8gc-x5hw-p9g9	6 Jun 202412:26	–	osv
OSV	CGA-6jhx-xgjg-cx6p	6 Jun 202412:23	–	osv
OSV	CGA-266c-v62g-2862	6 Jun 202412:20	–	osv
OSV	Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)	28 Feb 202422:57	–	osv
OSV	CVE-2024-25126	29 Feb 202400:15	–	osv
OSV	CGA-pqqq-69p9-48g7	6 Jun 202412:26	–	osv

Vulners

Node

-rackRange0.4–2.2.8.1

-rackRange3.0.0–3.0.9.1

Source	Link
github	www.github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx
github	www.github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462
github	www.github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49
discuss	www.discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-25126
lists	www.lists.debian.org/debian-lts-announce/2024/04/msg00022.html
security	www.security.netapp.com/advisory/ntap-20240510-0005
github	www.github.com/advisories/GHSA-22f2-v57c-j9cx

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

28 Feb 2024 22:57Current

5.1Medium risk

Vulners AI Score5.1

EPSS0.000

CWE-1333