onyx --cves cve-2024-26142
CVE-2024-26142
- score
- <0.1
- cvss
- 7.5
- epss
- 1.5%
- published
- 2024-02-27
- kev added
- —
- first seen
Rails 7.1.0 and later contains a ReDoS vulnerability in Accept header parsing caused by regex processing in Action Dispatch, letting attackers cause denial of service, exploit requires sending crafted headers.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
Exploit availability
Weaknesses
References 5
- https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
- https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
- https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
- https://security.netapp.com/advisory/ntap-20240503-0003/