CVE-2024-39316

{"id": "CVE-2024-39316", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-07-02T16:15:04.753", "references": [{"url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix."}, {"lang": "es", "value": "Rack es una interfaz modular de servidor web Ruby. A partir de la versi\u00f3n 3.1.0 y antes de la versi\u00f3n 3.1.5, existe una vulnerabilidad de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) en el m\u00f3dulo `Rack::Request::Helpers` al analizar los encabezados de aceptaci\u00f3n HTTP. Esta vulnerabilidad puede ser aprovechada por un atacante que env\u00eda encabezados \"Accept-Encoding\" o \"Accept-Language\" especialmente manipulados, lo que hace que el servidor dedique demasiado tiempo a procesar la solicitud y provoque una denegaci\u00f3n de servicio (DoS). La soluci\u00f3n para CVE-2024-26146 no se aplic\u00f3 a la rama principal y, por lo tanto, aunque el problema se solucion\u00f3 para la serie de versiones Rack v3.0, no se solucion\u00f3 en la serie de versiones v3.1 hasta la v3.1.5. Los usuarios de versiones de la rama 3.1 deben actualizar a la versi\u00f3n 3.1.5 para recibir la soluci\u00f3n."}], "lastModified": "2025-10-10T16:36:05.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "FD9FC600-59C1-4363-BA89-3C946E729C90", "versionEndExcluding": "3.1.5", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}