CVE-2024-35231 Overview
CVE-2024-35231 is a denial of service vulnerability in rack-contrib, a library providing contributed middleware and utilities for Rack, the Ruby web server interface. Versions prior to 2.5.0 fail to constrain the user-controlled profiler_runs parameter, allowing a remote attacker to allocate unbounded server-side resources. The flaw is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. Maintainers released version 2.5.0 to address the issue.
Critical Impact
Unauthenticated remote attackers can trigger unbounded resource allocation through the profiler middleware, exhausting server capacity and causing application-wide denial of service.
Affected Products
- rack-contrib Ruby gem versions prior to 2.5.0
- Rack-based Ruby web applications using the Profiler middleware
- Downstream applications bundling vulnerable rack-contrib releases
Discovery Timeline
- 2024-05-27 - CVE-2024-35231 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-35231
Vulnerability Analysis
The rack-contrib library exposes a profiler middleware that triggers application profiling based on HTTP request parameters. The middleware reads the profiler_runs parameter from incoming requests and uses it to determine how many profiling iterations to execute.
No upper bound is applied to this value. An attacker can submit a single request specifying an arbitrarily large profiler_runs value, forcing the server to allocate memory and consume CPU cycles for each requested run. The result is resource exhaustion on the targeted host.
The vulnerability is remotely exploitable without authentication or user interaction. The attack scope changes because exhaustion of the Ruby process affects all other tenants and services hosted by the same worker.
Root Cause
The root cause is missing input validation on the profiler_runs request parameter inside the profiler middleware. The middleware trusts client-supplied data and passes it directly to the profiling loop. This matches the pattern described by [CWE-770], where an application allocates resources based on attacker-controlled input without enforcing a quota.
Attack Vector
An attacker sends an HTTP request to any endpoint handled by an application that mounts the vulnerable profiler middleware. The request includes a profiler_runs parameter set to a large integer. The middleware honors the value and begins executing the requested number of profiling runs, allocating memory and CPU until the worker process becomes unresponsive or crashes.
The fix in version 2.5.0 introduces a server-side cap on the number of allowable profiler runs. Refer to the GitHub commit applying the fix and the GitHub Security Advisory GHSA-8c8q-2xw3-j869 for implementation details.
Detection Methods for CVE-2024-35231
Indicators of Compromise
- HTTP requests containing a profiler_runs query string or form parameter with unusually large numeric values
- Sudden memory growth or CPU saturation in Ruby/Rack worker processes following profiler-related requests
- Repeated requests from a single source targeting endpoints that load the Rack::Contrib::Profiler middleware
Detection Strategies
- Inspect web server and application logs for requests containing profiler_runs parameters and flag values that exceed a sane threshold
- Audit deployed Ruby applications to identify those mounting Rack::Contrib::Profiler and confirm the installed rack-contrib gem version using bundle list rack-contrib
- Deploy web application firewall rules that block or rate-limit requests carrying profiler-related parameters
Monitoring Recommendations
- Track resident memory and CPU per Ruby worker and alert on sustained spikes correlated with profiler requests
- Monitor application response times and worker restarts as a proxy for resource exhaustion events
- Aggregate request parameter telemetry to a central data store and search for anomalous profiler_runs values over time
How to Mitigate CVE-2024-35231
Immediate Actions Required
- Upgrade rack-contrib to version 2.5.0 or later in all Ruby projects using the library
- Remove Rack::Contrib::Profiler from the middleware stack in production environments where profiling is not required
- Restrict access to profiler endpoints to trusted internal networks until patching is complete
Patch Information
Version 2.5.0 of rack-contrib contains the fix, which constrains the profiler_runs value to a bounded range. Update the gem dependency in your Gemfile and run bundle update rack-contrib. The patch is available in the upstream commit 0eec2a9.
Workarounds
- Disable or unmount the profiler middleware in production by removing the use Rack::Contrib::Profiler directive from config.ru or application configuration
- Add a reverse proxy or WAF rule that strips or rejects requests containing the profiler_runs parameter
- Enforce per-request resource limits at the application server level (for example, request timeouts and memory caps on Puma or Unicorn workers)
# Configuration example
# Update Gemfile to require the patched version
gem 'rack-contrib', '>= 2.5.0'
# Apply the upgrade
bundle update rack-contrib
bundle list rack-contrib
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
