High severity · published Feb 27, 2024
CVE-2024-26142
Rails is a web-application framework
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rails · Rubyonrails
7.1.0 before 7.1.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-26142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-26142
Vendor Advisory
https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
Patch
https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
Vendor Advisory
https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
Third Party Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240503-0003/
More from Rails
7.5
CVE-2019-5418
Rails Ruby on Rails Path Traversal Vulnerability
7.5
CVE-2016-0752
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows…
7.5
CVE-2014-0130
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x…
9.8
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
9.8
CVE-2024-28103
Action Pack is a framework for handling and responding to web requests