Description
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| rails | rails | >= 7.1.0, < 7.1.3.1 |
| rails | rails | >= 7.1.0, <= 7.1.3.1 |
References
- https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946Vendor Advisory
- https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272Patch
- https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wqVendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.ymlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240503-0003/Third Party Advisory
- https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946Vendor Advisory
- https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272Patch
- https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wqVendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.ymlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240503-0003/Third Party Advisory
Timeline
- Published
- Feb 27, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed