Read the docs
TI-2024-16580 Aliases CVE-2024-25126GHSA-22f2-v57c-j9cx

Rack ReDos in content type parsing (2nd degree polynomial)

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 18 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.35376 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial rack (rack): 3.0.9.1, 2.2.8.1rack (RubyGems): 3.0.9.1, 2.2.8.1Red Hat: 9 advisoriesRed Hat: 18 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrack3.0.0 to before 3.0.9.1; 0.4 to before 2.2.8.13.0.9.1, 2.2.8.1Patch availableCNA
—rack (RubyGems)3.0.0 to before 3.0.9.13.0.9.1Patch availableGHSA-22f2-v57c-j9cx
—rack (RubyGems)0.4 to before 2.2.8.12.2.8.1Patch availableGHSA-22f2-v57c-j9cx
  • rack Vendorrack Affected 3.0.0 to before 3.0.9.1; 0.4 to before 2.2.8.1 Fixed in 3.0.9.1, 2.2.8.1 Patch available CNA
  • rack (RubyGems) Vendor— Affected 3.0.0 to before 3.0.9.1 Fixed in 3.0.9.1 Patch available GHSA-22f2-v57c-j9cx
  • rack (RubyGems) Vendor— Affected 0.4 to before 2.2.8.1 Fixed in 2.2.8.1 Patch available GHSA-22f2-v57c-j9cx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*0.4 to before 2.2.8.1; 3.0.0 to before 3.0.9.1Vulnerablerack
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions 0.4 to before 2.2.8.1; 3.0.0 to before 3.0.9.1 Vulnerable ·rack
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA rack (rack) Fixed in 3.0.9.1, 2.2.8.1
  • Fix · GHSA-22f2-v57c-j9cx rack (RubyGems) Fixed in 3.0.9.1 Advisory →
  • Fix · GHSA-22f2-v57c-j9cx rack (RubyGems) Fixed in 2.2.8.1 Advisory →

Red Hat 9 advisories

  • RHSA-2024:10806 Released 2024-12-04 · Red Hat rating Moderate
    Satellite 6.15.5 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 python-pulp-container-2.16.9-2.el8pc, python3.11-pulp-container-2.16.9-2.el8pc, rubygem-activestorage-6.1.7.7-1.el8sat +1
  • RHSA-2024:3431 Released 2024-05-28 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.8.6) pcs-0.10.12-6.el8_6.5, pcs-snmp-0.10.12-6.el8_6.5
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) pcs-0.10.12-6.el8_6.5, pcs-snmp-0.10.12-6.el8_6.5
  • RHSA-2024:2953 Released 2024-05-22 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10, pcs-snmp-0.10.18-2.el8_10
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10, pcs-snmp-0.10.18-2.el8_10
Show 6 more Red Hat advisories
  • RHSA-2024:2584 Released 2024-04-30 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
  • RHSA-2024:2581 Released 2024-04-30 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) pcs-0.10.15-4.el8_8.2, pcs-snmp-0.10.15-4.el8_8.2
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) pcs-0.10.15-4.el8_8.2, pcs-snmp-0.10.15-4.el8_8.2
  • RHSA-2024:2113 Released 2024-04-30 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 9) pcs-0.11.7-2.el9_4, pcs-snmp-0.11.7-2.el9_4
    • Red Hat Enterprise Linux ResilientStorage (v. 9) pcs-0.11.7-2.el9_4, pcs-snmp-0.11.7-2.el9_4
  • RHSA-2024:2007 Released 2024-04-23 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v. 8.2) pcs-0.10.4-6.el8_2.5, pcs-snmp-0.10.4-6.el8_2.5
    • Red Hat Enterprise Linux High Availability TUS (v. 8.2) pcs-0.10.4-6.el8_2.5, pcs-snmp-0.10.4-6.el8_2.5
  • RHSA-2024:1846 Released 2024-04-16 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs-0.11.4-7.el9_2.1, pcs-snmp-0.11.4-7.el9_2.1
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs-0.11.4-7.el9_2.1, pcs-snmp-0.11.4-7.el9_2.1
  • RHSA-2024:1841 Released 2024-04-16 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.0) pcs-0.11.1-10.el9_0.5, pcs-snmp-0.11.1-10.el9_0.5
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) pcs-0.11.1-10.el9_0.5, pcs-snmp-0.11.1-10.el9_0.5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2024:2584
Red Hat Enterprise Linux High Availability E4S (v. 8.2)Fixed RHSA-2024:2007
Red Hat Enterprise Linux High Availability EUS (v.8.6)Fixed RHSA-2024:3431
Red Hat Enterprise Linux High Availability EUS (v.8.8)Fixed RHSA-2024:2581
Red Hat Enterprise Linux High Availability EUS (v.9.0)Fixed RHSA-2024:1841
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2024:1846
Red Hat Enterprise Linux High Availability TUS (v. 8.2)Fixed RHSA-2024:2007
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2024:2953
Red Hat Enterprise Linux HighAvailability (v. 9)Fixed RHSA-2024:2113
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)Fixed RHSA-2024:2584
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)Fixed RHSA-2024:2584
Red Hat Enterprise Linux Resilient Storage EUS (v.8.6)Fixed RHSA-2024:3431
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)Fixed RHSA-2024:2581
Red Hat Enterprise Linux Resilient Storage EUS (v.9.0)Fixed RHSA-2024:1841
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2024:1846
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2024:2953
Red Hat Enterprise Linux ResilientStorage (v. 9)Fixed RHSA-2024:2113
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2024:10806
Not affected: 2 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Satellite 6.15 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25126
  2. 2026-10-03 Alias added: GHSA-22f2-v57c-j9cx

References

Exploit 3

Patch 2

Advisory 2

Other 3

  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-29398 Unbounded-Parameter DoS in Rack::QueryParser CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences