CVE-2024-39316: Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
(updated )
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Rack::Request::Helpers module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted Accept-Encoding or Accept-Language headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS).
References
- advisory.dw1.io/61
- github.com/advisories/GHSA-cj83-2ww7-mvq7
- github.com/rack/rack
- github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
- github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
- nvd.nist.gov/vuln/detail/CVE-2024-39316
Code Behaviors & Features
Detect and mitigate CVE-2024-39316 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →