CVE-2024-25126: Rack ReDos in content type parsing (2nd degree polynomial)
Vulnerability summary
CVE-2024-25126 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 35.38% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 3 public exploits are recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 24 · Related 18Timeline
- 28-02-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
35.38%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 35.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundRack
Maturity: poc
Ruby Advisory Db
Maturity: poc
Exploit Reference (discuss.rubyonrails.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard6 products
- kube-fluentd-operator< 1.18.2-r3
- kube-fluentd-operator-compat< 1.18.2-r3
- kube-fluentd-operator-default-config< 1.18.2-r3
- kube-fluentd-operator-oci-entrypoint< 1.18.2-r3
- ruby3.2-rack< 3.0.9.1-r0
Wolfi6 products
- kube-fluentd-operator< 1.18.2-r3
- kube-fluentd-operator-compat< 1.18.2-r3
- kube-fluentd-operator-default-config< 1.18.2-r3
- kube-fluentd-operator-oci-entrypoint< 1.18.2-r3
- ruby3.2-rack< 3.0.9.1-r0
Debian2 products
- ruby-rack< 2.2.6.4-1+deb12u1 | < 2.2.7-1.1
- debian_linuxEOL10.0
Rack1 product
- rack≥ 0.4, < 2.2.8.1 | ≥ 3.0.0, < 3.0.9.1
RubyGems1 product
- rack≥ 3.0.0, < 3.0.9.1 | ≥ 0.4, < 2.2.8.1
Ubuntu1 product
- ruby-rack< 2.0.7-2ubuntu0.1+esm5 | < 2.1.4-5ubuntu1.1 | < 2.1.4-5ubuntu1+esm5 | < 2.2.7-1ubuntu0.1
6 vendors · 17 products
References
18 links- github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cxX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941X Refsource MISCWEBExploitVendor Advisory
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.ymlX Refsource MISCAdvisoryWEBExploitThird Party Advisory
Show all 18 references
- github.com/rack/rackPACKAGE