CVE-2024-26142

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-26142

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26142.json

Aliases

• GHSA-jjhx-jhvp-74wq

Published

2024-02-27T16:15:46Z

Modified

2024-05-03T15:01:09.794279Z

Details

Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

References

• https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
• https://security.netapp.com/advisory/ntap-20240503-0003/
• https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
• https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946