CVE-2024-26141mediumCWE-400

CVE-2024-26141: medium-severity vulnerability in rack

Possible DoS Vulnerability with Range Header in Rack

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.8epss 1.6%
exploitation probability
1.6%top 25% of all CVEs
observed exploitation
nono source reports it
In short

A flaw in Rack's Range header handling allows attackers to craft special requests that trick the server into sending extremely large responses, overwhelming it and making it unavailable to legitimate users.

Technical detail

The vulnerability exists in Rack::File middleware and Rack::Utils.byte_ranges methods where maliciously crafted Range headers bypass proper validation, causing excessive memory allocation and network bandwidth consumption. This affects Rails applications and other Rack-based servers, leading to denial of service when processing the unexpectedly large responses.

Summary generated and translated by AI from the official description.
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Affected products
rack · rack
Related CVEs — rack

In the same product, most dangerous first.

CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2019-16782MEDIUMPossible Information Leak / Session Hijack Vulnerability in RackEPSS 3.7%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2025-25184MEDIUMPossible Log Injection in Rack::CommonLoggerEPSS 1.2%CVE-2025-27610HIGHLocal File Inclusion in Rack::StaticEPSS 1.2%
References
https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48bhttps://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.ymlhttps://lists.debian.org/debian-lts-announce/2024/04/msg00022.htmlhttps://security.netapp.com/advisory/ntap-20240510-0007/