CVE-2024-26141
published 2024-02-29CVE-2024-26141: Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.61%
73.5th percentile
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | ruby-rack | < ruby-rack 2.2.6.4-1+deb12u1 (bookworm) | ruby-rack 2.2.6.4-1+deb12u1 (bookworm) |
| debian | ruby-rack | < ruby-rack 3.2.6-2 (sid) | ruby-rack 3.2.6-2 (sid) |
| rack | rack | < 2.2.23 | 2.2.23 |
| rack | rack | < 2.2.23 | 2.2.23 |
| rack | rack | — | — |
| rack | rack | — | — |
| rack | rack | >= 0 < 2.2.23 | 2.2.23 |
| rack | rack | >= 1.3.0 < 2.2.8.1 | 2.2.8.1 |
| rack | rack | >= 1.3.0 < 2.2.8.1 | 2.2.8.1 |
| rack | rack | >= 3.0.0 < 3.1.21 | 3.1.21 |
| rack | rack | >= 3.0.0 < 3.0.9.1 | 3.0.9.1 |
| rack | rack | >= 3.0.0 < 3.0.9.1 | 3.0.9.1 |
| rack | rack | >= 3.0.0.beta1 < 3.1.21 | 3.1.21 |
| rack | rack | >= 3.2.0 < 3.2.6 | 3.2.6 |
| rack | rack | >= 3.2.0 < 3.2.6 | 3.2.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.8MEDIUM
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
rubygem-rack Header Range denial of service (Nessus ID 207797 / WID-SEC-2026-1687)
vuldb·2026-05-28·CVSS 7.5
CVE-2024-26141 [HIGH] rubygem-rack Header Range denial of service (Nessus ID 207797 / WID-SEC-2026-1687)
A vulnerability labeled as problematic has been found in rubygem-rack. Impacted is an unknown function of the component Header Handler. Such manipulation of the argument Range leads to denial of service.
This vulnerability is referenced as CVE-2024-26141. The attack needs to be initiated within the local network. No exploit is available.
The affected component should be upgraded.
OSV
CVE-2026-34826: Rack is a modular Ruby web server interface
osv·2026-04-02·CVSS 7.5
CVE-2026-34826 [HIGH] CVE-2026-34826: Rack is a modular Ruby web server interface
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
GHSA
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
ghsa·2026-04-02·CVSS 7.5
CVE-2026-34826 [HIGH] CWE-400 Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
## Summary
`Rack::Utils.get_byte_ranges` parses the HTTP `Range` header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as `0-0,0-0,0-0,...` to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request.
This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses.
## Details
`Rack::Utils.get_byte_ranges` accepts a comma-separated list of byte ranges and validates them based on their aggregate size, b
OSV
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
osv·2026-04-02·CVSS 7.5
CVE-2026-34826 [HIGH] Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
## Summary
`Rack::Utils.get_byte_ranges` parses the HTTP `Range` header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as `0-0,0-0,0-0,...` to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request.
This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses.
## Details
`Rack::Utils.get_byte_ranges` accepts a comma-separated list of byte ranges and validates them based on their aggregate size, b
OSV
ruby-rack vulnerabilities
osv·2024-09-26·CVSS 7.5
CVE-2022-30122 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the application. (CVE-2022-30123)
It was discovered that Rack
OSV
ruby-rack vulnerabilities
osv·2024-08-19·CVSS 7.5
CVE-2024-25126 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-25126)
It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create
large responses, leading to a denial of service. (CVE-2024-26141)
It was discovered that Rack incorrectly handled certain crafted headers. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-26146)
OSV
ruby-rack vulnerabilities
osv·2024-06-17·CVSS 7.5
CVE-2023-27530 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack incorrectly handled Multipart MIME parsing. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected Ubuntu
23.10. (CVE-2023-27530)
It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-25126)
It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create large
responses, leading to a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2024-26141)
It was discovered that Rack incorrectly handled certain crafted headers.
OSV
ruby-rack vulnerabilities
osv·2024-03-12·CVSS 5.3
CVE-2023-27539 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack incorrectly parse some headers.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)
OSV
CVE-2024-26141: Rack is a modular Ruby web server interface
osv·2024-02-29·CVSS 7.5
CVE-2024-26141 [HIGH] CVE-2024-26141: Rack is a modular Ruby web server interface
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
OSV
Rack has possible DoS Vulnerability with Range Header
osv·2024-02-28·CVSS 7.5
CVE-2024-26141 [HIGH] Rack has possible DoS Vulnerability with Range Header
Rack has possible DoS Vulnerability with Range Header
# Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in
Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0.
Not affected: < 1.3.0
Fixed Versions: 3.0.9.1, 2.2.8.1
Impact
Carefully crafted Range headers can cause a server to respond with an
unexpectedly large response. Responding with such large responses could lead
to a denial of service issue.
Vulnerable applications will use the `Rack::File` middleware or the
`Rack::Utils.byte_ranges` methods (this includes Rails applications).
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this
GHSA
Rack has possible DoS Vulnerability with Range Header
ghsa·2024-02-28·CVSS 7.5
CVE-2024-26141 [HIGH] CWE-400 Rack has possible DoS Vulnerability with Range Header
Rack has possible DoS Vulnerability with Range Header
# Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in
Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0.
Not affected: < 1.3.0
Fixed Versions: 3.0.9.1, 2.2.8.1
Impact
Carefully crafted Range headers can cause a server to respond with an
unexpectedly large response. Responding with such large responses could lead
to a denial of service issue.
Vulnerable applications will use the `Rack::File` middleware or the
`Rack::Utils.byte_ranges` methods (this includes Rails applications).
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this
Red Hat
rack: Rack: Denial of Service via malicious HTTP Range header
vendor_redhat·2026-04-02·CVSS 5.8
CVE-2026-34826 [MEDIUM] CWE-770 rack: Rack: Denial of Service via malicious HTTP Range header
rack: Rack: Denial of Service via malicious HTTP Range header
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
A flaw was found in Rack. A remote a
Debian
CVE-2026-34826: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a...
vendor_debian·2026·CVSS 5.8
CVE-2026-34826 [MEDIUM] CVE-2026-34826: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a...
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: resolved (fixed in 3.2.6-2)
trixie: open
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-09-26·CVSS 7.5
CVE-2024-25126 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the ap
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-08-19·CVSS 5.3
CVE-2024-25126 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-25126)
It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create
large responses, leading to a denial of service. (CVE-2024-26141)
It was discovered that Rack incorrectly handled certain crafted headers. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-26146)
Instructions: After a standard sys
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-06-17·CVSS 7.5
CVE-2024-25126 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack incorrectly handled Multipart MIME parsing. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected Ubuntu
23.10. (CVE-2023-27530)
It was discovered that Rack incorrectly parsed certain media types. A
remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. (CVE-2024-25126)
It was discovered that Rack incorrectly handled certain Range headers. A
remote attacker could possibly use this issue to cause Rack to create large
responses, leading to a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2024-26141)
It was discovered
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-03-12·CVSS 5.3
CVE-2024-26146 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Rack could be made do denial of service if it received a specially
crafted header.
It was discovered that Rack incorrectly parse some headers.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-rack: Possible DoS Vulnerability with Range Header in Rack
vendor_redhat·2024-02-22·CVSS 5.8
CVE-2024-26141 [MEDIUM] CWE-1333 rubygem-rack: Possible DoS Vulnerability with Range Header in Rack
rubygem-rack: Possible DoS Vulnerability with Range Header in Rack
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Range Header. Carefully crafted range headers can cause a server to respond with an unexpectedly large response. Responding with large responses could lead to a denial of service issue.
Statement: Red Hat rates this vulnerability as a M
Debian
CVE-2024-26141: ruby-rack - Rack is a modular Ruby web server interface. Carefully crafted Range headers can...
vendor_debian·2024·CVSS 5.8
CVE-2024-26141 [MEDIUM] CVE-2024-26141: ruby-rack - Rack is a modular Ruby web server interface. Carefully crafted Range headers can...
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
Scope: local
bookworm: resolved (fixed in 2.2.6.4-1+deb12u1)
bullseye: resolved (fixed in 2.1.4-3+deb11u2)
forky: resolved (fixed in 2.2.7-1.1)
sid: resolved (fixed in 2.2.7-1.1)
trixie: resolved (fixed in 2.2.7-1.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34826 rack: Rack: Denial of Service via malicious HTTP Range header
bugzilla·2026-04-02·CVSS 7.5
CVE-2026-34826 [HIGH] CVE-2026-34826 rack: Rack: Denial of Service via malicious HTTP Range header
CVE-2026-34826 rack: Rack: Denial of Service via malicious HTTP Range header
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
HackerOne
Possible DoS Vulnerability with Range Header in Rack
hackerone·2024-09-25·CVSS 5.8
CVE-2024-26141 [MEDIUM] Possible DoS Vulnerability with Range Header in Rack
Possible DoS Vulnerability with Range Header in Rack
I made a report and patch at https://hackerone.com/reports/2307813.
https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
> There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
> Versions Affected: >= 1.3.0. Not affected: Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.
> Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).
Possible DoS Vulnerability with Range Header in Rack
There is a
Wiz
CVE-2026-34826 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.8
CVE-2026-34826 [MEDIUM] CVE-2026-34826 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34826 :
Ruby vulnerability analysis and mitigation
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Source : NVD
## 5.3
Score
Pub
https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48bhttps://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.ymlhttps://lists.debian.org/debian-lts-announce/2024/04/msg00022.htmlhttps://security.netapp.com/advisory/ntap-20240510-0007/https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48bhttps://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.ymlhttps://lists.debian.org/debian-lts-announce/2024/04/msg00022.htmlhttps://security.netapp.com/advisory/ntap-20240510-0007/
2024-02-29
Published