2281 matches found
GHSA-22F2-V57C-J9CX Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
Summary ruby module Rack class MediaType SPLITPATTERN = %r\s;,\s The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split. PoC A simple HTTP request with lots of blank characters in the content-type header: ruby request"Content-Type" = " "...
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
Summary ruby module Rack class MediaType SPLITPATTERN = %r\s;,\s The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split. PoC A simple HTTP request with lots of blank characters in the content-type header: ruby request"Content-Type" = " "...
GHSA-22F2-V57C-J9CX vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
GHSA-22F2-V57C-J9CX vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, ruby3.2-rack...
Rack has possible DoS Vulnerability with Range Header
Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact...
GHSA-XJ5V-6V4G-JFW6 vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
GHSA-XJ5V-6V4G-JFW6 Rack has possible DoS Vulnerability with Range Header
Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact...
GHSA-54RR-7FVW-6X8F vulnerabilities
Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...
Rack Header Parsing leads to Possible Denial of Service Vulnerability
Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4,...
GHSA-54RR-7FVW-6X8F vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, ruby3.2-rack...
GHSA-54RR-7FVW-6X8F Rack Header Parsing leads to Possible Denial of Service Vulnerability
Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4,...
Regular Expression Denial Of Service (ReDoS)
rack is vulnerable to a Denial Of Service. This vulnerability is due the handling of content type parsing which utilizes a regex pattern with inefficient complexity, which allows attackers to launch DoS attacks...
PT-2024-28440 · Rack · Rack
Name of the Vulnerable Software and Affected Versions: Rack versions 3.1.0 through 3.1.4 Rack versions prior to 2.0.9.4 Rack versions prior to 2.1.4.4 Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in th...
Rack Security Vulnerabilities
Rack is the modular Ruby web server interface. A security vulnerability in Rack versions prior to 2.0.9.4, prior to 2.1.4.4, prior to 2.2.8.1, and prior to 3.0.9.1 stems from a carefully crafted header that could cause Rack's media type parser to take longer than expected, resulting in a denial o...
Rack Resource Management Error Vulnerability
Rack is a modular Ruby web server interface. A resource management error vulnerability exists in Rack versions prior to 3.0.9.1, 2.2.8.1, and 2.2.8.1, which stems from a crafted Range header that may cause the server to respond abnormally, resulting in a denial of service...
Rack Security Vulnerabilities
Rack is a modular Ruby web server interface. A security vulnerability exists in Rack versions prior to 3.0.9.1, 2.2.8.1, and 2.2.8.1, which stems from a carefully crafted content type header that could cause Rack's media type parser to take longer than expected, resulting in a denial of service...
Insecure File Permissions
rack-cors is vulnerable to Insecure File Permissions. The vulnerability is due to the distribution of files with world-writable permissions. This can potentially lead to unauthorized disclosure or modification...
CVE-2024-27456
An insecure file permission flaw was found in rack-cors. The permissions for .rb files distributed with rack-cors ruby gem are set to 0666 by default, which may allow users with low privileges to edit files. This issue impacts integrity, confidentiality, and availability...