BREW-mailcatcher-CVE-2024-25126 — Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

Affected: Homebrew: mailcatcher

### Summary

```ruby module Rack class MediaType SPLIT_PATTERN = %r{\s*[;,]\s*} ``` The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split.

### PoC

A simple HTTP request with lots of blank characters in the content-type header:

```ruby request["Content-Type"] = (" " * 50_000) + "a," ```

### Impact

It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.

CVE-2024-25126 — Rack ReDos in content type parsing (2nd degree polynomial)

Affected: rack, rack_project rack

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Most recent entries from all

BREW-mailcatcher-CVE-2024-25126 — Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

CVE-2024-25126 — Rack ReDos in content type parsing (2nd degree polynomial)