-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack | rubygems | >= 3.1.0, < 3.1.5 | 3.1.5 |
Miggo AIRoot Cause AnalysisThe core vulnerability exists in parse_http_accept_header which used problematic regex patterns for splitting headers. The commit diff shows replacement of regex splits with simple string splits and strip operations to mitigate ReDoS. The accept_encoding and accept_language methods are explicitly mentioned in advisories as entry points that trigger the vulnerable parsing logic. The Rack::Deflater middleware's use of accept_encoding (via Utils.select_best_encoding) creates an implicit attack surface even when applications don't directly use these methods.
Ongoing coverage of React2Shell