CVE-2024-35231 - CVE House

Back to Database

Status published High CVE-2024-35231

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 CVSS

Vulnerability Description

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35231

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from rack

View All →

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Rack has Possible Information Disclosure Vulnerability

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Affected Vendor

rack

View all reports →

Affected Software

rack-contrib

Vulnerable Versions:

< 2.5.0

Timeline

Official Publish: May 27th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery