CVE-2024-25126
Rack ReDos in content type parsing (2nd degree polynomial)
Summary
Rack ReDos in content type parsing (2nd degree polynomial)
Original description
The description as published by the source.
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-25126 ruby-rack Fixed in: 2.1.4-3+deb11u2
References
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- patch github.com
- web discuss.rubyonrails.org
- web lists.debian.org