Description

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.

INFO

Published Date :

2024-05-27T16:40:08.678Z

Last Modified :

2024-08-02T03:07:46.936Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-35231 vulnerability.

Vendors Products
Rack
  • Rack-contrib
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-35231.

URL Resource
https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7 cve-icon cve-icon
https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact