Rails ReDoS: CVE-2024-26142 and the Accept Header Parsing Flaw

CVE-2024-26142 lets an attacker freeze a Rails 7.1.x application with a single HTTP header. A crafted Accept header ties up server CPU and causes a denial of service. The flaw is subtle but severe. It sits in Action Dispatch's header parsing, and it is a textbook case of regular expression complexity turning into a real-world threat.

Technical information

Vulnerability mechanism:

CVE-2024-26142 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Accept header parsing logic of Action Dispatch, introduced in Rails 7.1.0. The problem is in the parse_media_range method in the actionpack gem, which uses a regular expression with nested quantifiers to parse media types from the Accept header. On ordinary headers, the regex is fast. It handles this one without trouble:

Accept: text/html,application/xhtml+xml

An attacker can instead send an Accept header built from repetitive patterns and ambiguous quantifiers, which pushes the regex engine into catastrophic backtracking. A header like this one:

Accept: aaaaaaaaaaaaaaaaaaaaaaaa!

can make the parser burn through CPU cycles until the application thread effectively hangs.

Vulnerable pattern (conceptual):

/^([^,\s]+,?)*\s*;.*$/

The outer * and inner + quantifiers can overlap, so malicious input produces an exponential number of matching paths.

Attack vector:

1. The attacker sends an HTTP request with a malicious Accept header to any Rails endpoint.
2. The vulnerable regex in Action Dispatch tries to parse the header.
3. Catastrophic backtracking ties up server resources and may lead to a denial of service.

Root cause:

• An inefficient regular expression with nested quantifiers in Accept header parsing.
• No input validation or limits on header complexity.

Affected configurations:

• Rails applications running 7.1.0 through 7.1.3.0
• Ruby versions prior to 3.2 (Ruby 3.2+ includes regex engine improvements that mitigate this attack)

Patch details: The Rails team replaced the problematic regex with a more efficient parsing approach that uses atomic groups and stricter quantifier boundaries. The fix ships in Rails 7.1.3.1 and is also available as a standalone patch.

Patch information

The Rails team fixed the vulnerability in version 7.1.3.1. The patch changes the regular expression that parses the Accept header in Action Dispatch so that it runs efficiently and no longer allows the denial-of-service attack.

The fix is in the parse_media_range method of the actionpack gem. The original implementation used a regular expression that could backtrack excessively on maliciously crafted Accept headers. The revised implementation replaces it with a more efficient parsing approach, which reduces the risk of ReDoS attacks.

You can review the changes in commit b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272 on the Rails GitHub repository, which shows every modification made to mitigate the vulnerability.

If you can't upgrade to version 7.1.3.1 right away, the Rails team provides a patch file named 7-1-accept-redos.patch. You can apply it to an existing installation to fix the vulnerability without a full version upgrade. The patch is available in the security announcement on the Ruby on Rails Discussions forum.

Applications running on Ruby 3.2 or newer are not affected by this vulnerability, because of mitigations built into the Ruby language itself. Upgrading to Ruby 3.2 or later can therefore also protect against this vulnerability and similar ones.

Affected systems and versions

• Rails versions 7.1.0 through 7.1.3.0 are vulnerable.
• Rails 7.1.3.1 and later are patched.
• Ruby versions prior to 3.2 are affected when used with vulnerable Rails versions.
• Ruby 3.2 and newer are not affected, even with vulnerable Rails versions, because of regex engine improvements.
• Any configuration that parses Accept headers through Action Dispatch in the affected version range is at risk.

Vendor security history

Ruby on Rails has a strong record of responding quickly to security issues. The core team typically releases patches for critical vulnerabilities within 24-48 hours of disclosure. Earlier issues, including previous ReDoS and header parsing vulnerabilities, were fixed quickly and in the open. The Rails project maintains a dedicated security mailing list and a public vulnerability disclosure process. The handling of this CVE fits that established record of responsible vulnerability management.

References

• NVD entry for CVE-2024-26142
• MITRE CVE entry
• Rails security advisory
• Rails Discussions security announcement
• Patch commit on GitHub
• RubySec advisory database
• NetApp advisory

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]