CVE-2024-39316

{
  "id": "CVE-2024-39316",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39316",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T13:50:23.901915Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rack",
          "product": "rack",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.1.0, < 3.1.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-07-02T16:15:04.753",
  "references": [
    {
      "url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f",
      "tags": [
        "Not Applicable"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). The fix for CVE-2024-26146 was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5. Users of versions on the 3.1 branch should upgrade to version 3.1.5 to receive the fix."
    },
    {
      "lang": "es",
      "value": "Rack es una interfaz modular de servidor web Ruby. A partir de la versión 3.1.0 y antes de la versión 3.1.5, existe una vulnerabilidad de denegación de servicio de expresión regular (ReDoS) en el módulo `Rack::Request::Helpers` al analizar los encabezados de aceptación HTTP. Esta vulnerabilidad puede ser aprovechada por un atacante que envía encabezados \"Accept-Encoding\" o \"Accept-Language\" especialmente manipulados, lo que hace que el servidor dedique demasiado tiempo a procesar la solicitud y provoque una denegación de servicio (DoS). La solución para CVE-2024-26146 no se aplicó a la rama principal y, por lo tanto, aunque el problema se solucionó para la serie de versiones Rack v3.0, no se solucionó en la serie de versiones v3.1 hasta la v3.1.5. Los usuarios de versiones de la rama 3.1 deben actualizar a la versión 3.1.5 para recibir la solución."
    }
  ],
  "lastModified": "2026-06-17T07:41:42.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD9FC600-59C1-4363-BA89-3C946E729C90",
              "versionEndExcluding": "3.1.5",
              "versionStartIncluding": "3.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}