actionpack ist anfällig für einen Denial of Service über einen manipulierten HTTP Accept Header

An attacker can exploit CVE-2016-0751 by sending a specially crafted HTTP Accept header to a vulnerable Ruby on Rails application. This header manipulates the MIME type cache, causing the application to allocate excessive memory. The resulting memory exhaustion can lead to application crashes, service unavailability, and potentially impact other services sharing the same resources. The blast radius is limited to the affected Rails application instance, but a successful attack could disrupt critical business operations if the application is essential. While no direct data exfiltration is possible, the DoS effectively renders the application unusable, preventing legitimate users from accessing it.

Organizations running Ruby on Rails applications, particularly those with older versions (prior to 4.2.5.1), are at risk. Shared hosting environments where multiple applications share server resources are particularly vulnerable, as a successful attack on one application can impact others. Legacy applications that haven't been regularly updated are also at increased risk.

• linux / server:

journalctl -u puma -g 'MIME type cache' | grep -i error

• generic web:

curl -I 'http://your-rails-app.com' -H 'Accept: a' | grep 'Content-Type:'

• ruby: Check application logs for excessive memory allocation related to MIME type processing. Look for errors or warnings indicating memory exhaustion.

1. 2016-07-21Discovery

   discovery

2. 2017-10-24Disclosure

   disclosure

1. Veröffentlicht2017-10-24
2. Geändert2024-11-29
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2016-0751 is to upgrade to Ruby on Rails version 4.2.5.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as rate limiting HTTP requests based on the Accept header or implementing a WAF rule to filter out suspicious Accept headers. Monitor application memory usage closely and consider increasing memory limits if necessary. Review and update any custom MIME type handling logic to ensure it does not introduce similar vulnerabilities. After upgrade, confirm the fix by sending a crafted Accept header and verifying that memory consumption remains within acceptable limits.