Internet Bug Bounty · Report #2446433

[CVE-2024-26146] Header Parsing leads to Possible Denial of Service Vulnerability

Validstatus

lowseverity

27upvotes

24 May 2024disclosed

Summary

Possible Denial of Service Vulnerability in Rack Header Parsing

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

Impact Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

Full Security Advisory: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942 GHSA:https://github.com/advisories/GHSA-54rr-7fvw-6x8f

How it was found

I've made a report and provided a patch https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942

Impact

Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original