CVE-2024-39316 json
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
published 2024-07-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2325 , GHSA-cj83-2ww7-mvq7
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | rack | >=3.1.0, <3.1.5 |
3.1.5 |
Affected products
- rack rack
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
web, patch
-
github.com
/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
web, vendor-advisory
-
github.com
/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2024-39316
advisory
-
advisory.dw1.io
/61
web
-
github.com
/rack/rack
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
web
Sources
- CVE List CVE-2024-39316
- GitHub Advisory GHSA-cj83-2ww7-mvq7
- NVD CVE-2024-39316
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.