Description
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| rack | rack-contrib | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1519 | rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue. |
 Github GHSA |
GHSA-8c8q-2xw3-j869 | rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T03:07:46.936Z
Reserved: 2024-05-14T15:39:41.785Z
Link: CVE-2024-35231
Vulnrichment
Updated: 2024-05-28T16:20:54.480Z
NVD
Status : Deferred
Published: 2024-05-27T17:15:09.760
Modified: 2026-04-15T00:35:42.020
Link: CVE-2024-35231
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses