Vulnerability · Published Feb 28, 2024 · Assigned by GitHub_M
CVE-2024-26146Possible Denial of Service Vulnerability in Rack Header Parsing
Medium 5.3
In plain English
A medium-severity regular-expression denial of service in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10 | ALSA-2024:2953 |
| AlmaLinux:9 | pcs-snmp | 0.11.7-2.el9_4 | ALSA-2024:2113 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DSA-5698-1 |
| Debian:12 | ruby-rack | 2.2.6.4-1+deb12u1 | DEBIAN-CVE-2024-26146 |
| Debian:13 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-26146 |
| Debian:14 | ruby-rack | 2.2.7-1.1 | DEBIAN-CVE-2024-26146 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10 | RLSA-2024:2953 |
| RubyGems | rack | 3.0.9.1 | GHSA-54rr-7fvw-6x8f |
| RubyGems | rack | 2.2.8.1 | GHSA-54rr-7fvw-6x8f |
| RubyGems | rack | 2.1.4.4 | GHSA-54rr-7fvw-6x8f |
| RubyGems | rack | 2.0.9.4 | GHSA-54rr-7fvw-6x8f |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | USN-7036-1 |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1 | UBUNTU-CVE-2024-26146 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | USN-6837-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.1 | UBUNTU-CVE-2024-26146 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f x_refsource_CONFIRM
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716 x_refsource_MISC
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582 x_refsource_MISC
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f x_refsource_MISC
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd x_refsource_MISC
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942 x_refsource_MISC
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0006/