CVE-2024-26141: Possible DoS Vulnerability with Range Header in Rack
Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.
Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byteranges methods (this includes Rails applications).
Releases -------- The fixed releases are available at the normal locations.
Workarounds ----------- There are no feasible workarounds for this issue.
Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
3-0-range.patch - Patch for 3.0 series 2-2-range.patch - Patch for 2.2 series
Credits -------
Thank you oooooooq for the report and patch
Other sources
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byteranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
— Launchpad
There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.
Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact
There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.
Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26141?
CVE-2024-26141 is categorized as a possible Denial of Service (DoS) vulnerability.
How do I fix CVE-2024-26141?
To fix CVE-2024-26141, you should upgrade to rack version 2.2.8.1 or 3.0.9.1 or later.
Which versions are affected by CVE-2024-26141?
CVE-2024-26141 affects rack versions 1.3.0 and higher.
What software is impacted by CVE-2024-26141?
CVE-2024-26141 impacts the rack library used in Ruby applications.
How can I determine if I'm using an affected version of rack for CVE-2024-26141?
You can determine if you're using an affected version by checking your rack version against the vulnerability details.