Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-stpq-7qys-t3cf
Vulnerability ID VCID-stpq-7qys-t3cf
Aliases CVE-2024-39316
GHSA-cj83-2ww7-mvq7
Summary Rack ReDoS Vulnerability in HTTP Accept Headers Parsing ### Summary A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). ### Details The fix for https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.5 https://advisory.dw1.io/61
generic_textual MODERATE https://advisory.dw1.io/61
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
epss 0.00833 https://api.first.org/data/v1/epss?cve=CVE-2024-39316
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-cj83-2ww7-mvq7
cvssv3.1 6.5 https://github.com/rack/rack
generic_textual MODERATE https://github.com/rack/rack
cvssv3.1 6.5 https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
generic_textual MODERATE https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
ssvc Track https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
cvssv3.1 6.5 https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
generic_textual MODERATE https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
ssvc Track https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
cvssv3 6.5 https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
cvssv3.1 6.5 https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
cvssv3.1_qr MODERATE https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
generic_textual MODERATE https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
ssvc Track https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
cvssv3.1 6.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2024-39316
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-39316
Reference id Reference type URL
https://advisory.dw1.io/61
https://api.first.org/data/v1/epss?cve=CVE-2024-39316
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rack/rack
https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
https://nvd.nist.gov/vuln/detail/CVE-2024-39316
GHSA-cj83-2ww7-mvq7 https://github.com/advisories/GHSA-cj83-2ww7-mvq7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://advisory.dw1.io/61
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T13:50:23Z/ Found at https://github.com/rack/rack/commit/412c980450ca729ee37f90a2661f166a9665e058
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T13:50:23Z/ Found at https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T13:50:23Z/ Found at https://github.com/rack/rack/security/advisories/GHSA-cj83-2ww7-mvq7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-39316.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-39316
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.74546
EPSS Score 0.00833
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:22.030968+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-cj83-2ww7-mvq7/GHSA-cj83-2ww7-mvq7.json 38.0.0