CVE-2024-25126
rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 22, 2024
Updated · September 17, 2026
Description
A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is currently available for this vulnerability. The recommendation is to perform updates as soon as they are available.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1333 · Inefficient Regular Expression Complexity