CVE-2024-35231

Published: May 27, 2024Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7

Source: security-advisories@github.com

https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869

Source: security-advisories@github.com

https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.