CVE-2024-25126: medium-severity vulnerability in rack
Rack ReDos in content type parsing (2nd degree polynomial)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Rack's content type parser can be slowed down by specially crafted HTTP headers, causing the web server to become unresponsive. This is a denial of service attack that affects the parsing logic.
A second-degree polynomial ReDoS vulnerability exists in Rack's media type parser when processing malicious Content-Type headers. An unauthenticated remote attacker can send crafted requests to exhaust server resources and trigger a denial of service condition. The vulnerability is resolved in versions 3.0.9.1 and 2.2.8.1.
In the same product, most dangerous first.