Denial of Service Vulnerability in Rack Content-Type Parsing

Security Announcements
,
1

There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.

Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1

Impact

Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack’s media type parser to parse content type headers. This code will look like below:

request.media_type

## OR
request.media_type_params

## OR
Rack::MediaType.type(content_type)

Some frameworks (including Rails) call this code internally, so upgrading is recommended!

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 3-0-media-type.patch - Patch for 3.0 series
  • 2-2-media-type.patch - Patch for 2.2 series

Credits

Thanks to @byroot and @jeremyevans for the patch, also thank you to svalkanov for reporting this issue!

2-2-media-type.patch (1.6 KB) 3-0-media-type.patch (1.6 KB)

2 Likes