Vulnerability in Rack

CVE-2024-39316

Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.009 (56.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 56.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-39316: held from 0.009 to 0.009.

EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000

Affected products

  • Rack — versions >= 3.1.0, < 3.1.5

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2024-39316?
CVE-2024-39316 is a medium-severity vulnerability in Rack, classified under Inefficient Regular Expression Complexity. CVSS score: 6.5/10. Published 2024-07-02.
How severe is CVE-2024-39316?
Medium severity. CVSS v3 base score is 6.5 out of 10.