CVE-2024-26141

Possible DoS Vulnerability with Range Header in Rack

Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Scores

Weaknesses (CWE)

• CWE-400

Advisories

• GHSA-xj5v-6v4g-jfw6 — Rack has possible DoS Vulnerability with Range Header

European references

• ENISA EUVD · EUVD-2024-0768
• GCVE · GCVE-0-2024-26141

CERT-FR advisories

• CERTFR-2025-AVI-1129 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2024-AVI-0160 — Multiples vulnérabilités dans Ruby on Rails · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* ≥ 1.3.0 < 2.2.8.1
• cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* ≥ 3.0.0 < 3.0.9.1
• cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Affected products

References

• https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6
• https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9
• https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b
• https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml
• https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
• https://security.netapp.com/advisory/ntap-20240510-0007/

Sources