CVE-2024-35231

What it actually does

Unbounded server-side resource allocation triggered by an unconstrained user-controlled profiler_runs parameter in the rack-contrib profiler middleware, allowing remote attackers to exhaust memory or CPU without authentication.

Why it matters to the business

Service denial leading to application unavailability, degraded performance for legitimate users, and potential operational disruption until the affected service is restarted or scaled.

How an attack unfolds

An attacker repeatedly submits HTTP requests containing an arbitrarily large value for the profiler_runs query parameter to the profiler middleware endpoint; because no upper bound exists, each request causes progressive allocation of server resources until the process becomes unresponsive or crashes.

How to fix it

Upgrade rack-contrib to version 2.5.0 or later, which includes the patch committed in d5265bc4f849f4bf55b230d3a0929e513acd5fac. If immediate upgrade is not feasible, disable the profiler middleware or add application-level input validation to cap profiler_runs.

How to confirm the fix worked

Confirm the installed rack-contrib version is 2.5.0 or newer; test by sending requests with profiler_runs values exceeding any intended limit and verify that the server rejects or caps the input without excessive resource use.

Typical attack path

1. Identify an endpoint protected by rack-contrib profiler middleware
2. Craft requests that include a large or repeated profiler_runs parameter
3. Send high-volume requests from one or more sources without rate limiting
4. Observe server resource exhaustion resulting in denial of service

How to detect it

Inspect web server and application logs for repeated requests to profiler-related paths that contain unusually large or repeated profiler_runs parameters; correlate with resource utilization spikes or process restarts.

• profiler_runs=
• /__rack__/profiler
• rack-contrib profiler

What your security team should do

• Apply the 2.5.0 upgrade across all environments within the next maintenance window
• Implement web application firewall rules to block or throttle requests containing large profiler_runs values
• Monitor application performance metrics for sudden spikes in memory or CPU correlated with profiler endpoints
• Review and restrict exposure of profiler middleware in production