CVE-2024-26142highCWE-1333

CVE-2024-26142: high-severity vulnerability in rails

Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch

Published · Updated

Follow this CVE+ Monitor rails+ Monitor actionpack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.5%
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
rails · rails
Related CVEs — rails

In the same product, most dangerous first.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 30.1%CVE-2022-23633HIGHExposure of sensitive information in Action PackEPSS 2.2%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%CVE-2024-47887MEDIUMAction Controller has possible ReDoS vulnerability in HTTP Token authenticationEPSS 1.0%