CVE-2024-26141

    Dashboard / Vulnerabilities / CVE-2024-26141

    CVE-2024-26141

    Published: 28 Feb 2024Last Modified: 28 Oct 2026

    Summary: Possible DoS Vulnerability with Range Header in Rack

    Details: Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

    References: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944, https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26141.json, https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml, https://nvd.nist.gov/vuln/detail/CVE-2024-26141, https://security.netapp.com/advisory/ntap-20240510-0007/, https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9, https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a50dda57c1426b6b38ed06fa08cab154285c8057
    Fixed -e83001100ad9dd24e1744b13669dcb2736a13ebd

    Affected versions

    v2.2.8
    v2.2.7
    v2.2.6.2
    v2.2.6.1
    v2.2.6
    v2.2.5
    v2.2.2
    v2.2.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-26141 | CVE-DB