CVE-2024-26146: Possible Denial of Service Vulnerability in Rack Header Parsing
First published: Fri Feb 23 2024(Updated: )
# Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1 Impact ------ Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 2-0-header-redos.patch - Patch for 2.0 series * 2-1-header-redos.patch - Patch for 2.1 series * 2-2-header-redos.patch - Patch for 2.2 series * 3-0-header-redos.patch - Patch for 3.0 series Credits ------- Thanks to [svalkanov](https://hackerone.com/svalkanov) for reporting this and providing patches!
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/rack | <2.0.9.4 | 2.0.9.4 |
| rubygems/rack | >=2.1.0<2.1.4.4 | 2.1.4.4 |
| rubygems/rack | >=2.2.0<2.2.8.1 | 2.2.8.1 |
| rubygems/rack | >=3.0.0<3.0.9.1 | 3.0.9.1 |
| redhat/rubygem-rack | <2.0.9.4 | 2.0.9.4 |
| redhat/rubygem-rack | <2.1.4.4 | 2.1.4.4 |
| redhat/rubygem-rack | <2.2.8.1 | 2.2.8.1 |
| redhat/rubygem-rack | <3.0.9.1 | 3.0.9.1 |
| debian/ruby-rack | 2.1.4-3+deb11u2 2.2.6.4-1+deb12u1 3.0.8-4 | |
| Rack | >=0.4<2.0.9.4 | |
| Rack | >=2.1.0<2.1.4.4 | |
| Rack | >=2.2.0<2.2.8.1 | |
| Debian | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
- https://nvd.nist.gov/vuln/detail/CVE-2024-26146
- https://github.com/advisories/GHSA-54rr-7fvw-6x8f (Advisory)
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0006/
- https://launchpad.net/bugs/cve/CVE-2024-26146
- https://github.com/rack/rack/releases/tag/v2.2.8.1
- https://security-tracker.debian.org/tracker/CVE-2024-26146
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26146
- https://ubuntu.com/security/CVE-2024-26146
- https://access.redhat.com/security/cve/CVE-2024-25126
- https://access.redhat.com/security/cve/CVE-2024-26141
- https://access.redhat.com/security/cve/CVE-2024-26146
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2265601
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2265598
- https://access.redhat.com/errata/RHSA-2024:1841
- https://access.redhat.com/errata/RHSA-2024:1846
- https://access.redhat.com/errata/RHSA-2024:2007
- https://access.redhat.com/errata/RHSA-2024:2113
- https://access.redhat.com/errata/RHSA-2024:2581
- https://access.redhat.com/errata/RHSA-2024:2584
- https://access.redhat.com/errata/RHSA-2024:2953
- https://access.redhat.com/errata/RHSA-2024:3431
- https://access.redhat.com/errata/RHSA-2024:10806
- https://bugzilla.redhat.com/show_bug.cgi?id=2265595
Frequently Asked Questions
What is the severity of CVE-2024-26146?
CVE-2024-26146 is classified as a Denial of Service vulnerability in Rack header parsing.
How do I fix CVE-2024-26146?
To fix CVE-2024-26146, update Rack to versions 2.0.9.4, 2.1.4.4, 2.2.8.1, or 3.0.9.1.
Which versions of Rack are affected by CVE-2024-26146?
All versions of Rack are affected by CVE-2024-26146.
What types of applications are vulnerable to CVE-2024-26146?
Any application using the affected versions of Rack for header parsing is vulnerable to CVE-2024-26146.
Is there a workaround for CVE-2024-26146?
There is no known workaround for CVE-2024-26146; the only mitigation is to upgrade to a fixed version of Rack.
- agent/weakness
- agent/title
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-54rr-7fvw-6x8f
- alias/CVE-2024-26146
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- agent/references
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/event
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/rubygems
- package-manager/redhat
- package-manager/debian
- vendor/rack
- canonical/rack
- version/rack/0.4
- version/rack/2.1.0
- version/rack/2.2.0
- vendor/debian
- canonical/debian
- version/debian/10.0