CVE-2024-26142

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Inefficient Regular Expression Complexity pada rubyonrails rails. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

Rincian

Terbit di NVD

27 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/849... advisory vendor
• https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq advisory vendor
• https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 patch
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240503-0003/ advisory pihak ketiga