CVE-2024-26146

Published: Feb 29, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Affected (4)

Products: Rack: Rack · Debian: Debian Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Rack Rack	From 0.4 to 2.0.9.4
Rack Rack	From 2.1.0 to 2.1.4.4
Rack Rack	From 2.2.0 to 2.2.8.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (18)

https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942

Source: security-advisories@github.com

Vendor Advisory

https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716

Source: security-advisories@github.com

Patch

https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582

Source: security-advisories@github.com

Patch

https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f

Source: security-advisories@github.com

Patch

https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd

Source: security-advisories@github.com

Patch

https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f

Source: security-advisories@github.com

Vendor Advisory

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml

Source: security-advisories@github.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html

Source: security-advisories@github.com

Mailing List

https://security.netapp.com/advisory/ntap-20240510-0006/

Source: security-advisories@github.com

Third Party Advisory

https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://security.netapp.com/advisory/ntap-20240510-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.