CVE-2024-26142: Rails Action Dispatch DoS Vulnerability

CVE-2024-26142 Overview

CVE-2024-26142 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Ruby on Rails web application framework. The flaw exists in the Accept header parsing routines of Action Dispatch, starting in Rails version 7.1.0. Attackers can send specially crafted HTTP Accept headers to trigger catastrophic backtracking in the underlying regular expression, exhausting CPU resources on the target server.

The vulnerability is patched in Rails 7.1.3.1. Applications running on Ruby 3.2 or newer are unaffected because the Ruby runtime includes mitigations against ReDoS attack patterns. The issue is tracked under [CWE-1333] (Inefficient Regular Expression Complexity).

Critical Impact
Remote unauthenticated attackers can cause sustained denial of service against Rails 7.1.x applications by sending malicious Accept headers that trigger excessive backtracking in the request parsing logic.

Affected Products

Ruby on Rails versions 7.1.0 through 7.1.3 (Action Dispatch component)
Ruby language runtime versions prior to 3.2
NetApp products bundling affected Rails versions (per NetApp advisory)

Discovery Timeline

2024-02-27 - CVE-2024-26142 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26142

Vulnerability Analysis

The vulnerability resides in how Action Dispatch parses the HTTP Accept header from incoming requests. Rails uses a regular expression to tokenize media types, quality factors, and parameters within the header value. The regex contains overlapping quantifiers that exhibit catastrophic backtracking when given carefully crafted input strings.

When an attacker submits a maliciously constructed Accept header, the regex engine attempts an exponential number of matching paths before failing. This consumes a worker process or thread for an extended period. Because HTTP requests typically arrive on a limited pool of worker threads, a small number of malicious requests can saturate the application server and prevent legitimate users from receiving responses.

The vulnerability requires no authentication and no user interaction. It is exploitable over the network against any Rails 7.1.x endpoint that processes incoming requests, which is effectively every public route.

Root Cause

The root cause is an inefficient regular expression used during content negotiation in Action Dispatch. The pattern allows multiple ways to match identical substrings, leading to exponential time complexity on adversarial input. Ruby versions prior to 3.2 lack runtime ReDoS protections, so the regex executes without bounded backtracking.

Attack Vector

Exploitation requires only the ability to send HTTP requests to the target Rails application. An attacker constructs an Accept header containing repetitive token sequences designed to maximize backtracking. Each malicious request blocks a worker thread for seconds to minutes depending on input length, allowing scalable resource exhaustion with minimal attacker bandwidth.

The vulnerability is described in detail in the Rails security advisory and the Ruby on Rails discussion thread. The upstream fix is available in the Rails patch commit.

Detection Methods for CVE-2024-26142

Indicators of Compromise

Sustained spikes in CPU utilization on Rails application servers without corresponding increases in legitimate request volume
Unusually long request processing times for endpoints that previously responded quickly
HTTP requests containing abnormally long or repetitive Accept header values
Increased worker thread or Puma/Unicorn queue saturation logged by the application server

Detection Strategies

Inspect web server and reverse proxy logs for Accept headers exceeding normal length thresholds or containing repeated token patterns
Correlate request latency metrics with Accept header content to identify slow-processing requests linked to ReDoS payloads
Run software composition analysis against Gemfile.lock to identify Rails versions between 7.1.0 and 7.1.3

Monitoring Recommendations

Enable request timeout enforcement in the application server and alert on requests exceeding the configured threshold
Monitor Rack middleware timing to detect requests where Action Dispatch parsing dominates execution time
Track p95 and p99 response latency per endpoint to surface DoS attempts early

How to Mitigate CVE-2024-26142

Immediate Actions Required

Upgrade Rails to version 7.1.3.1 or later, which contains the patched regular expression
Where possible, upgrade the Ruby runtime to version 3.2 or newer to inherit runtime ReDoS mitigations
Apply vendor-specific patches referenced in the NetApp security advisory for bundled distributions

Patch Information

The official fix is delivered in Rails 7.1.3.1. The corrective change is documented in the GitHub commit b4d3bfb and the GHSA-jjhx-jhvp-74wq advisory. Operators should also review the Ruby Advisory Database entry for ecosystem guidance.

Workarounds

Deploy a Web Application Firewall (WAF) rule that rejects HTTP requests with Accept headers exceeding a reasonable length (for example, 256 bytes)
Enforce request execution timeouts at the application server layer (Puma worker_timeout, Unicorn timeout) to bound the impact of any single slow request
Place a reverse proxy in front of Rails that validates and normalizes the Accept header before forwarding traffic

bash

# Update the Rails gem to the patched release
bundle update rails --conservative

# Verify the installed version is 7.1.3.1 or later
bundle exec rails --version

# Example nginx rule to limit Accept header length
# (place inside the relevant server block)
if ($http_accept ~* ".{257,}") {
    return 400;
}