Denial of Service Vulnerability in Rack Content-Type Parsing

There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.

Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions:,


Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack’s media type parser to parse content type headers. This code will look like below:


## OR

## OR

Some frameworks (including Rails) call this code internally, so upgrading is recommended!

All users running an affected release should either upgrade or use one of the workarounds immediately.


The fixed releases are available at the normal locations.


There are no feasible workarounds for this issue.


To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 3-0-media-type.patch - Patch for 3.0 series
  • 2-2-media-type.patch - Patch for 2.2 series


Thanks to @byroot and @jeremyevans for the patch, also thank you to svalkanov for reporting this issue!

2-2-media-type.patch (1.6 KB) 3-0-media-type.patch (1.6 KB)