CVE-2024-41128: Action Dispatch has possible ReDoS vulnerability in query parameter filtering

Severity: medium (CVSS 6.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-16 · updated 2026-06-17
Weakness: CWE-770

Description

Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Affected products

Rails: from 3.1.0 through 6.1.7.9; from 7.0.0 before 7.0.8.5; from 7.1.0 before 7.1.4.1; from 7.2.0 before 7.2.1.1 — fixed in 7.0.8.5, 7.1.4.1, 7.2.1.1
Rubygems Actionpack: from 3.1.0 before 6.1.7.9; from 7.0.0 before 7.0.8.5; from 7.1.0 before 7.1.4.1; from 7.2.0 before 7.2.1.1; 3.1.0, 3.1.1, 3.1.1.rc1, 3.1.1.rc2, 3.1.1.rc3, 3.1.10 (+345) — fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1

How to fix

Upgrade to a fixed version: Rails 7.0.8.5, 7.1.4.1, 7.2.1.1; Rubygems Actionpack 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-41128 or the next vulnerability affects your stack