CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
10.3%
There is a possible denial of service vulnerability in the content type
parsing component of Rack. This vulnerability has been assigned the CVE
identifier CVE-2024-25126.
Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1
Carefully crafted content type headers can cause Rackβs media type parser to
take much longer than expected, leading to a possible denial of service
vulnerability.
Impacted code will use Rackβs media type parser to parse content type headers.
This code will look like below:
request.media_type
## OR
request.media_type_params
## OR
Rack::MediaType.type(content_type)
Some frameworks (including Rails) call this code internally, so upgrading is
recommended!
All users running an affected release should either upgrade or use one of the
workarounds immediately.
The fixed releases are available at the normal locations.
There are no feasible workarounds for this issue.
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
10.3%