CVE-2024-26142CWE-1333

Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch

High · published February 27, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
74.0
In the wild
Unconfirmed
What it is

Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01498 · 74.0th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-02-27T15:25Z
EPSS history
Timeline
  • 27 FEB 15:25Z
    Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
    cvelistv5