Redos in ActionDispatch Accept Header (Rails 7.1.x before 7.1.3.1)
CVE-2024-26142 Published on February 27, 2024
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
Vulnerability Analysis
CVE-2024-26142 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2024-26142. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a ReDoS Vulnerability?
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:
CVE-2024-26142 has been classified to as a ReDoS vulnerability or weakness.
Products Associated with CVE-2024-26142
Want to know whenever a new CVE is published for Ruby on Rails Rails? stack.watch will email you.
Affected Versions
rails:- Version >= 7.1.0, < 7.1.3.1 is affected.
- Version 7.1.0, <= 7.1.3.1 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2024-26142
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| rubygems | rails | >= 7.1.0, < 7.1.3.1 | 7.1.3.1 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.