Back to Database
Status published
Medium
CVE-2024-25126
Rack ReDos in content type parsing (2nd degree polynomial)
Vulnerability Description
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25126
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx
- https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462
- https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49
- https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0005/
More from rack
View All →CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
High
7.5
CVE-2025-61780
Rack has Possible Information Disclosure Vulnerability
Medium
5.8
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
High
7.5
CVE-2025-61771
Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
High
7.5
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
High
7.5
Affected Vendor
rack
View all reports →Affected Software
rack
Vulnerable Versions:
>= 3.0.0, < 3.0.9.1, >= 0.4, < 2.2.8.1
Timeline
Official Publish:
February 28th, 2024
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L