{"id":"CVE-2024-26141","aliases":["ALSA-2024:2113","ALSA-2024:2953","CLSA-2026-1790610331","CLSA-2026-1790610419","DEBIAN-CVE-2024-26141","DLA-3800-1","DSA-5698-1","EUVD-2024-0768","GHSA-xj5v-6v4g-jfw6","MGASA-2024-0123","OESA-2024-1820","OESA-2024-1821","OESA-2024-1822","OESA-2024-1823","RHSA-2024:10806","RHSA-2024:1841","RHSA-2024:1846","RHSA-2024:2007","RHSA-2024:2113","RHSA-2024:2581","RHSA-2024:2584","RHSA-2024:2953","RHSA-2024:3431","RLSA-2024:2953","SUSE-SU-2024:0765-1","SUSE-SU-2024:0946-1","SUSE-SU-2024:1131-1","UBUNTU-CVE-2024-26141","USN-6837-1","USN-6837-2","USN-7036-1","openSUSE-SU-2024:13726-1","openSUSE-SU-2024:13727-1","openSUSE-SU-2025:14811-1","openSUSE-SU-2025:14875-1","openSUSE-SU-2026:10286-1","openSUSE-SU-2026:10358-1"],"status":"published","title":"Possible DoS Vulnerability with Range Header in Rack","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01612,"percentile":0.76282,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-02-28T22:57:12Z","modified":"2026-11-02T12:01:03Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["3.0.9.1","2.2.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["2.2.6.4-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["2.2.7-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["2.2.7-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","fixed_in":["1.5.2-3+deb8u3ubuntu1~esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-3ubuntu0.2+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-4ubuntu0.2+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","fixed_in":["2.0.7-2ubuntu0.1+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","fixed_in":["2.2.7-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"2.2.8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6.4-1+deb12u1"}]}],"versions":["2.2.6.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-3+deb10u4"}]}],"versions":["2.0.6-3","2.0.6-3+deb10u1","2.0.6-3+deb10u2","2.0.6-3+deb10u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-3+deb11u2"}]}],"versions":["2.1.4-3","2.1.4-3+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6.4-1+deb12u1"}]}],"versions":["2.2.6.4-1"],"bundled":3},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.9.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.4.1","3.0.4.2","3.0.5","3.0.6","3.0.6.1","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"2.2.8.1"}]}],"versions":["1.3.0","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0.beta","1.6.0.beta2","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0.alpha","2.0.0.rc1","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.1","2.0.9.2","2.0.9.3","2.0.9.4","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.4.1","2.1.4.2","2.1.4.3","2.1.4.4","2.2.0","2.2.1","2.2.2","2.2.3","2.2.3.1","2.2.4","2.2.5","2.2.6","2.2.6.1","2.2.6.2","2.2.6.3","2.2.6.4","2.2.7","2.2.8"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-5.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-4.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-5.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.7-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.5"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.21.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-rack-1_4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u3ubuntu1~esm8"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3","1.5.2-3+deb8u3ubuntu1~esm4","1.5.2-3+deb8u3ubuntu1~esm6","1.5.2-3+deb8u3ubuntu1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.2+esm6"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1","1.6.4-3ubuntu0.2+esm2","1.6.4-3ubuntu0.2+esm4","1.6.4-3ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm6"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1","1.6.4-4ubuntu0.2+esm2","1.6.4-4ubuntu0.2+esm4","1.6.4-4ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm5"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2","2.0.7-2ubuntu0.1+esm3","2.0.7-2ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm5"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2","2.1.4-5ubuntu1+esm3","2.1.4-5ubuntu1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu0.1"}]}],"versions":["2.2.4-3","2.2.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu0.1"}]}],"versions":["2.2.4-3","2.2.7-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u3ubuntu1~esm8"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3","1.5.2-3+deb8u3ubuntu1~esm4","1.5.2-3+deb8u3ubuntu1~esm6","1.5.2-3+deb8u3ubuntu1~esm7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.2+esm6"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1","1.6.4-3ubuntu0.2+esm2","1.6.4-3ubuntu0.2+esm4","1.6.4-3ubuntu0.2+esm5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm6"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1","1.6.4-4ubuntu0.2+esm2","1.6.4-4ubuntu0.2+esm4","1.6.4-4ubuntu0.2+esm5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm5"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2","2.0.7-2ubuntu0.1+esm3","2.0.7-2ubuntu0.1+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm5"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2","2.1.4-5ubuntu1+esm3","2.1.4-5ubuntu1+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-1.3"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rack","product":"rack"},{"vendor":"rack_project","product":"rack"}],"references":[{"url":"https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web","article"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html","tags":["x_transferred","Mailing List","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26141","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xj5v-6v4g-jfw6"},{"url":"https://access.redhat.com/errata/RHSA-2024:2113","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-25126","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26141","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26146","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265593","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265594","tags":["report"]},{"url":"https://bugzilla.redhat.com/2265595","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2113.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2953","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-2953.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610331.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790610419.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26141.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26141","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0123.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33075","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44572","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1821","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1822","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1823","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10806","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266063","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-28466","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28665","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28689","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28690","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28691","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28693","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28695","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28696","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28697","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10806.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23342","tags":["advisory"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md","tags":["article"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp","tags":["article"]},{"url":"https://minerva.crocs.fi.muni.cz/","tags":["article"]},{"url":"https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-25126","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26141","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26144","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26146","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1841","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1841.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1846","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1846.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2007","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2007.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-15217","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7582","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7583","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7669","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7672","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7697","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7698","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7700","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7703","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7719","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7724","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7725","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7730","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7738","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7739","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7740","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7744","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7746","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2113.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2581","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2581.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2584","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2584.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17280","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7584","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7668","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7729","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7731","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7732","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7741","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7742","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7743","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7745","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-8467","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2953.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3431","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3431.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2953","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240765-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220239","tags":["report"]},{"url":"https://bugzilla.suse.com/1220242","tags":["report"]},{"url":"https://bugzilla.suse.com/1220248","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240946-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241131-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-26141","tags":["report"]},{"url":"https://github.com/rack/rack/releases/tag/v2.2.8.1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6689-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6837-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6837-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7036-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27539","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/ruby-rack/+bug/2078711","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FLQ74D2IZAJC5KD6QXVUZAQ6O5LNAWZX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-26141","title":"Possible DoS Vulnerability with Range Header in Rack","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-28T23:28:10.503Z","modified":"2025-02-13T17:41:04.867Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-0768","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-28T23:28:10Z","modified":"2025-02-13T17:41:04Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:46.532099Z"}],"ghsa":[{"id":"GHSA-xj5v-6v4g-jfw6","title":"Rack has possible DoS Vulnerability with Range Header","description":"# Possible DoS Vulnerability with Range Header in Rack\n\nThere is a possible DoS vulnerability relating to the Range request header in\nRack.  This vulnerability has been assigned the CVE identifier CVE-2024-26141.\n\nVersions Affected:  \u003e= 1.3.0.\nNot affected:       \u003c 1.3.0\nFixed Versions:     3.0.9.1, 2.2.8.1\n\nImpact\n------\nCarefully crafted Range headers can cause a server to respond with an\nunexpectedly large response. Responding with such large responses could lead\nto a denial of service issue.\n\nVulnerable applications will use the `Rack::File` middleware or the\n`Rack::Utils.byte_ranges` methods (this includes Rails applications).\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n* 3-0-range.patch - Patch for 3.0 series\n* 2-2-range.patch - Patch for 2.2 series\n\nCredits\n-------\n\nThank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and\npatch","status":"published","published":"2024-02-28T22:57:12Z","modified":"2026-03-18T05:07:32Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2024-26141","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-29T00:15:51.403Z","modified":"2026-06-17T07:17:11.073Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-26141","title":"Possible DoS Vulnerability with Range Header in Rack","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-28T23:28:10.503Z","modified":"2026-10-28T02:30:33.044513696Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26141","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-29T00:15:51.403Z","modified":"2026-11-02T12:01:03.12282625Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1820","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:29.198268417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1821","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:28.378223263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1822","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:28.380623437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1823","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:29.285793723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:10806","title":"Red Hat Security Advisory: Satellite 6.15.5 Async Update","status":"published","published":"2024-12-05T10:02:41Z","modified":"2026-09-18T10:02:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1841","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:37:36Z","modified":"2026-09-18T10:02:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1846","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:37:46Z","modified":"2026-09-18T10:02:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:2007","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:38:17Z","modified":"2026-09-18T10:03:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2113","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:38:40Z","modified":"2026-09-18T10:03:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2581","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:37:30Z","modified":"2026-09-18T10:03:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2584","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:37:21Z","modified":"2026-09-18T10:03:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2953","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:38:34Z","modified":"2026-09-18T10:03:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3431","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-30T16:39:05Z","modified":"2026-09-18T10:03:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2024-26141","description":"Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.","status":"published","published":"2024-02-29T00:15:00Z","modified":"2026-02-04T03:53:02.721693Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"ALSA-2024:2113","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)\n* rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)\n* rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:04.852224896Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2953","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)\n* rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)\n* rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.371884243Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1790610331","title":"pcs: Fix of 10 CVEs","description":"- Update bundled rubygem rack to 2.2.20\n- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing\n- CVE-2024-26141: fix response amplification from crafted Range headers\n- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing\n- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser\n- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters\n- CVE-2025-61770: fix unbounded multipart preamble buffering\n- CVE-2025-61771: fix unbounded buffering of non-file multipart fields\n- CVE-2025-61772: fix unbounded multipart part header buffering\n- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST\n- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500\n- CVE-2026-31958: cap multipart part count and part header size in bundled tornado\n- Disable multipart request parsing in pcsd, which does not use it\n- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and\n  npm has no i686 build, so the i686 buildroot cannot be created","status":"published","published":"2026-09-28T15:45:52Z","modified":"2026-10-26T09:31:44.061952334Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790610419","title":"pcs: Fix of 10 CVEs","description":"- Update bundled rubygem rack to 2.2.20\n- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing\n- CVE-2024-26141: fix response amplification from crafted Range headers\n- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing\n- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser\n- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters\n- CVE-2025-61770: fix unbounded multipart preamble buffering\n- CVE-2025-61771: fix unbounded buffering of non-file multipart fields\n- CVE-2025-61772: fix unbounded multipart part header buffering\n- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST\n- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500\n- CVE-2026-31958: cap multipart part count and part header size in bundled tornado\n- Disable multipart request parsing in pcsd, which does not use it\n- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and\n  npm has no i686 build, so the i686 buildroot cannot be created","status":"published","published":"2026-09-28T15:47:19Z","modified":"2026-10-26T09:31:51.622041107Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"DLA-3800-1","title":"ruby-rack - security update","status":"published","published":"2024-04-29T00:00:00Z","modified":"2026-03-09T01:17:58.228312Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5698-1","title":"ruby-rack - security update","status":"published","published":"2024-05-24T00:00:00Z","modified":"2026-03-09T02:08:35.531243Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"GHSA-xj5v-6v4g-jfw6","title":"Rack has possible DoS Vulnerability with Range Header","description":"# Possible DoS Vulnerability with Range Header in Rack\n\nThere is a possible DoS vulnerability relating to the Range request header in\nRack.  This vulnerability has been assigned the CVE identifier CVE-2024-26141.\n\nVersions Affected:  \u003e= 1.3.0.\nNot affected:       \u003c 1.3.0\nFixed Versions:     3.0.9.1, 2.2.8.1\n\nImpact\n------\nCarefully crafted Range headers can cause a server to respond with an\nunexpectedly large response. Responding with such large responses could lead\nto a denial of service issue.\n\nVulnerable applications will use the `Rack::File` middleware or the\n`Rack::Utils.byte_ranges` methods (this includes Rails applications).\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n* 3-0-range.patch - Patch for 3.0 series\n* 2-2-range.patch - Patch for 2.2 series\n\nCredits\n-------\n\nThank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and\npatch","status":"published","published":"2024-02-28T22:57:12Z","modified":"2026-09-10T03:50:00.330149102Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"MGASA-2024-0123","title":"Updated ruby-rack packages fix security vulnerabilities","description":"Carefully crafted content type headers can cause Rack’s media type\nparser to take much longer than expected, leading to a possible denial\nof service vulnerability (ReDos 2nd degree polynomial). (CVE-2024-25126)\nCarefully crafted Range headers can cause a server to respond with an\nunexpectedly large response. Responding with such large responses could\nlead to a denial of service issue. Vulnerable applications will use the\n`Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this\nincludes Rails applications). (CVE-2024-26141)\nCarefully crafted headers can cause header parsing in Rack to take\nlonger than expected resulting in a possible denial of service issue.\nAccept and Forwarded headers are impacted. (CVE-2024-26146)\n","status":"published","published":"2024-04-12T20:45:19Z","modified":"2026-04-16T04:42:51.222748116Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13726-1","title":"ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:59.579529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13727-1","title":"ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:46.684926Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14811-1","title":"ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T04:22:14.520853Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14875-1","title":"ruby3.4-rubygem-rack-3.1.12-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-11T00:00:00Z","modified":"2025-05-07T18:08:49.787747Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10358-1","title":"ruby4.0-rubygem-rack-3.1.18-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.361493Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RLSA-2024:2953","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)\n\n* rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)\n\n* rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:33.077645Z","modified":"2026-02-04T07:40:27.793178Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0765-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\n- CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239).\n- CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242).\n- CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248).\n","status":"published","published":"2024-03-05T12:47:00Z","modified":"2026-02-04T02:32:43.725593Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0946-1","title":"Security update for rubygem-rack-1_4","description":"This update for rubygem-rack-1_4 fixes the following issues:\n\n- CVE-2024-25126: Fixed a Denial of Service Vulnerability in Rack Content-Type Parsing (bsc#1220239)\n- CVE-2024-26141: Fixed a Denial of Service Vulnerability in Range request header parsing (bsc#1220242)\n- CVE-2024-26146: Fixed a Denial of Service vulnerability in Rack headers parsing routine (bsc#1220248)\n","status":"published","published":"2024-03-20T09:27:07Z","modified":"2026-02-04T04:15:25.683683Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1131-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\n- CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239).\n- CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242).\n- CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248).\n","status":"published","published":"2024-04-08T09:28:18Z","modified":"2025-05-02T04:36:33.153667Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6837-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack incorrectly handled Multipart MIME parsing. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n23.10. (CVE-2023-27530)\n\nIt was discovered that Rack incorrectly parsed certain media types. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-25126)\n\nIt was discovered that Rack incorrectly handled certain Range headers. A\nremote attacker could possibly use this issue to cause Rack to create large\nresponses, leading to a denial of service. This issue only affected Ubuntu\n24.04 LTS. (CVE-2024-26141)\n\nIt was discovered that Rack incorrectly handled certain crafted headers. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. This issue only affected Ubuntu\n24.04 LTS. (CVE-2024-26146)\n","status":"published","published":"2024-06-17T13:12:32Z","modified":"2026-02-10T04:44:20Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6837-2","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack incorrectly parsed certain media types. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. This issue only affected \nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-25126)\n\nIt was discovered that Rack incorrectly handled certain Range headers. A\nremote attacker could possibly use this issue to cause Rack to create \nlarge responses, leading to a denial of service. (CVE-2024-26141)\n\nIt was discovered that Rack incorrectly handled certain crafted headers. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-26146)\n","status":"published","published":"2024-08-19T00:28:21Z","modified":"2026-06-29T13:51:10.602654147Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7036-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack was not properly parsing data when processing\nmultipart POST requests. If a user or automated system were tricked into\nsending a specially crafted multipart POST request to an application using\nRack, a remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-30122)\n\nIt was discovered that Rack was not properly escaping untrusted data when\nperforming logging operations, which could cause shell escaped sequences\nto be written to a terminal. If a user or automated system were tricked\ninto sending a specially crafted request to an application using Rack, a\nremote attacker could possibly use this issue to execute arbitrary code in\nthe machine running the application. (CVE-2022-30123)\n\nIt was discovered that Rack did not properly structure regular expressions\nin some of its parsing components, which could result in uncontrolled\nresource consumption if an application using Rack received specially\ncrafted input. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-44570, CVE-2022-44571)\n\nIt was discovered that Rack did not properly structure regular expressions\nin its multipart parsing component, which could result in uncontrolled\nresource consumption if an application using Rack to parse multipart posts\nreceived specially crafted input. A remote attacker could possibly use\nthis issue to cause a denial of service. (CVE-2022-44572)\n\nIt was discovered that Rack incorrectly handled Multipart MIME parsing.\nA remote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2023-27530)\n\nIt was discovered that Rack incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nRack to consume resources, leading to a denial of service.\n(CVE-2023-27539)\n\nIt was discovered that Rack incorrectly parsed certain media types. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-25126)\n\nIt was discovered that Rack incorrectly handled certain Range headers. A\nremote attacker could possibly use this issue to cause Rack to create\nlarge responses, leading to a denial of service. (CVE-2024-26141)\n\nIt was discovered that Rack incorrectly handled certain crafted headers. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-26146)\n","status":"published","published":"2024-09-26T04:19:46Z","modified":"2026-02-10T04:45:27Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}