CVE-2024-26142

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26142
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 Vendor Advisory
https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 Patch
https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq Vendor Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0003/ Third Party Advisory
https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 Vendor Advisory
https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 Patch
https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq Vendor Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0003/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
History

14 Feb 2025, 16:22

Type Values Removed Values Added
References () https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 - () https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 - Vendor Advisory
References () https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 - () https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 - Patch
References () https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq - () https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq - Vendor Advisory
References () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml - () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240503-0003/ - () https://security.netapp.com/advisory/ntap-20240503-0003/ - Third Party Advisory
CPE cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
First Time Rubyonrails
Ruby-lang ruby
Ruby-lang
Rubyonrails rails

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 - () https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946 -
References () https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 - () https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 -
References () https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq - () https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq -
References () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml - () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml -
References () https://security.netapp.com/advisory/ntap-20240503-0003/ - () https://security.netapp.com/advisory/ntap-20240503-0003/ -

03 May 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240503-0003/ -

28 Feb 2024, 14:07

Type Values Removed Values Added
Summary
  • (es) Rails es un framework de aplicación web. A partir de la versión 7.1.0, existe una posible vulnerabilidad ReDoS en las rutinas de análisis del encabezado Aceptar de Action Dispatch. Esta vulnerabilidad está parcheada en 7.1.3.1. Ruby 3.2 tiene mitigaciones para este problema, por lo que las aplicaciones Rails que usan Ruby 3.2 o posterior no se ven afectadas.

27 Feb 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-27 16:15

Updated : 2025-02-14 16:22

NVD link : CVE-2024-26142

Mitre link : CVE-2024-26142

CVE.ORG link : CVE-2024-26142

JSON object : View

Products Affected

rubyonrails

  • rails

ruby-lang

  • ruby
CWE
CWE-1333

Inefficient Regular Expression Complexity