VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Feb 28, 2024· Updated Feb 13, 2025

Possible Denial of Service Vulnerability in Rack Header Parsing

CVE-2024-26146

Description

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rackRubyGems
>= 3.0.0, < 3.0.9.13.0.9.1
rackRubyGems
>= 2.2.0, < 2.2.8.12.2.8.1
rackRubyGems
>= 2.1.0, < 2.1.4.42.1.4.4
rackRubyGems
< 2.0.9.42.0.9.4

Affected products

1

Patches

4
30b8e39a578b

Fixing ReDoS in header parsing

https://github.com/rack/rackAaron PattersonFeb 21, 2024via ghsa
commit
1 file changed · +2 −2
  • lib/rack/utils.rb+2 −2 modified
    @@ -140,8 +140,8 @@ def build_nested_query(value, prefix = nil)
     module_function :build_nested_query
 
     def q_values(q_value_header)
-      q_value_header.to_s.split(/\s*,\s*/).map do |part|
-        value, parameters = part.split(/\s*;\s*/, 2)
+      q_value_header.to_s.split(',').map do |part|
+        value, parameters = part.split(';', 2).map(&:strip)
         quality = 1.0
         if md = /\Aq=([\d.]+)/.match(parameters)
           quality = md[1].to_f
a227cd793778

Fixing ReDoS in header parsing

https://github.com/rack/rackAaron PattersonFeb 21, 2024via ghsa
commit
1 file changed · +6 −5
  • lib/rack/utils.rb+6 −5 modified
    @@ -143,8 +143,8 @@ def build_nested_query(value, prefix = nil)
     end
 
     def q_values(q_value_header)
-      q_value_header.to_s.split(/\s*,\s*/).map do |part|
-        value, parameters = part.split(/\s*;\s*/, 2)
+      q_value_header.to_s.split(',').map do |part|
+        value, parameters = part.split(';', 2).map(&:strip)
         quality = 1.0
         if parameters && (md = /\Aq=([\d.]+)/.match(parameters))
           quality = md[1].to_f
@@ -157,9 +157,10 @@ def forwarded_values(forwarded_header)
       return nil unless forwarded_header
       forwarded_header = forwarded_header.to_s.gsub("\n", ";")
 
-      forwarded_header.split(/\s*;\s*/).each_with_object({}) do |field, values|
-        field.split(/\s*,\s*/).each do |pair|
-          return nil unless pair =~ /\A\s*(by|for|host|proto)\s*=\s*"?([^"]+)"?\s*\Z/i
+      forwarded_header.split(';').each_with_object({}) do |field, values|
+        field.split(',').each do |pair|
+          pair = pair.split('=').map(&:strip).join('=')
+          return nil unless pair =~ /\A(by|for|host|proto)="?([^"]+)"?\Z/i
           (values[$1.downcase.to_sym] ||= []) << $2
         end
       end
e4c117749ba2

Fixing ReDoS in header parsing

https://github.com/rack/rackAaron PattersonFeb 21, 2024via ghsa
commit
1 file changed · +2 −2
  • lib/rack/utils.rb+2 −2 modified
    @@ -142,8 +142,8 @@ def build_nested_query(value, prefix = nil)
     end
 
     def q_values(q_value_header)
-      q_value_header.to_s.split(/\s*,\s*/).map do |part|
-        value, parameters = part.split(/\s*;\s*/, 2)
+      q_value_header.to_s.split(',').map do |part|
+        value, parameters = part.split(';', 2).map(&:strip)
         quality = 1.0
         if parameters && (md = /\Aq=([\d.]+)/.match(parameters))
           quality = md[1].to_f
6c5d90bdcec0

Fixing ReDoS in header parsing

https://github.com/rack/rackAaron PattersonFeb 21, 2024via ghsa
commit
1 file changed · +2 −2
  • lib/rack/utils.rb+2 −2 modified
    @@ -146,8 +146,8 @@ def build_nested_query(value, prefix = nil)
     module_function :build_nested_query
 
     def q_values(q_value_header)
-      q_value_header.to_s.split(/\s*,\s*/).map do |part|
-        value, parameters = part.split(/\s*;\s*/, 2)
+      q_value_header.to_s.split(',').map do |part|
+        value, parameters = part.split(';', 2).map(&:strip)
         quality = 1.0
         if parameters && (md = /\Aq=([\d.]+)/.match(parameters))
           quality = md[1].to_f

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.