Rack ReDos in content type parsing (2nd degree polynomial)

CVE-2024-25126

What is CVE-2024-25126?

The Rack modular web server interface for Ruby has a vulnerability that exposes systems to denial of service attacks. By crafting specialized content type headers, an attacker can exploit the media type parser, resulting in excessive processing time and potentially rendering the application unavailable. This is classified as a ReDos (Regular Expression Denial of Service) vulnerability, which can occur in the context of complex data processing where the parser takes significantly longer than expected to analyze certain inputs. The issue has been addressed in recent versions 3.0.9.1 and 2.2.8.1, and users are advised to update their installations promptly to mitigate the risks.

References