{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T21:14:30.088","vulnerabilities":[{"cve":{"id":"CVE-2024-26142","sourceIdentifier":"security-advisories@github.com","published":"2024-02-27T16:15:46.600","lastModified":"2026-06-17T07:17:11.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected."},{"lang":"es","value":"Rails es un framework de aplicación web. A partir de la versión 7.1.0, existe una posible vulnerabilidad ReDoS en las rutinas de análisis del encabezado Aceptar de Action Dispatch. Esta vulnerabilidad está parcheada en 7.1.3.1. Ruby 3.2 tiene mitigaciones para este problema, por lo que las aplicaciones Rails que usan Ruby 3.2 o posterior no se ven afectadas."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rails","product":"rails","versions":[{"version":">= 7.1.0, < 7.1.3.1","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"rails","product":"rails","defaultStatus":"unknown","cpes":["cpe:2.3:a:rails:rails:*:*:*:*:*:*:*:*"],"versions":[{"version":"7.1.0","lessThanOrEqual":"7.1.3.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-02-28T20:01:00.813235Z","id":"CVE-2024-26142","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.0","versionEndExcluding":"7.1.3.1","matchCriteriaId":"F37CC5DE-B363-478B-B8F2-393412E05802"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0","matchCriteriaId":"F841AE5D-60DD-4E3A-854A-9B7B906BF7E7"}]}]}],"references":[{"url":"https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0003/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0003/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}