CVE-2024-26142
1 advisory.
RubyGems/actionpack CVE-2024-26142: low, EPSS 1.50%
Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Action: Upgrade actionpack to 7.1.3.1 or later.
bundle update actionpackAffected
| introduced | fixed | last affected |
|---|---|---|
| 7.1.0 | 7.1.3.1 | - |
Fixed versions
| 7.1.3.1 |
Sources
- osv: GHSA-jjhx-jhvp-74wq
- https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
- https://nvd.nist.gov/vuln/detail/CVE-2024-26142
- https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
- https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml
CVE-2024-26142 · published · modified · JSON