Vulnerability · Published Feb 28, 2024 · Assigned by GitHub_M
CVE-2024-26141Possible DoS Vulnerability with Range Header in Rack
Medium 5.8
In plain English
A medium-severity uncontrolled resource consumption in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs-snmp | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DSA-5698-1 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DEBIAN-CVE-2024-26141 |
| Debian:13 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-26141 |
| Debian:14 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-26141 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10 | RLSA-2024:2953 |
| RubyGems | rack | 2.2.8.1 | GHSA-xj5v-6v4g-jfw6 |
| RubyGems | rack | 3.0.9.1 | GHSA-xj5v-6v4g-jfw6 |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | UBUNTU-CVE-2024-26141 |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | USN-7036-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | USN-6837-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | UBUNTU-CVE-2024-26141 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References
- https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6 x_refsource_CONFIRM
- https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9 x_refsource_MISC
- https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b x_refsource_MISC
- https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944 x_refsource_MISC
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0007/