PT-2024-1926 · Rack+9 · Rack+9

Ooooooo-Q · Published 2024-02-21 · Updated 2026-03-13 · CVE-2024-26141

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rack versions 1.3.0 through 3.0.9 and 2.2.8.1.

Description Rack is a modular Ruby web server interface. A denial of service (DoS) vulnerability exists due to improper handling of Range headers. Carefully crafted Range headers can cause the server to respond with an unexpectedly large response, potentially leading to a denial of service. Applications using the Rack::File middleware or the Rack::Utils.byte ranges methods, including Rails applications, are vulnerable.

Recommendations Upgrade to Rack version 3.0.9.1 or 2.2.8.1 to address this vulnerability.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2024:2113

ALSA-2024:2953

ALSA-2024_2113

BDU:2024-01714

CESA-2024_2953

CVE-2024-26141

DLA-3800-1

DSA-5698-1

GHSA-XJ5V-6V4G-JFW6

INFSA-2024_2113

INFSA-2024_2953

MGASA-2024-0123

OESA-2024-1820

OESA-2024-1821

OESA-2024-1822

OESA-2024-1823

OPENSUSE-SU-2024:13726-1

OPENSUSE-SU-2024:13727-1

OPENSUSE-SU-2024_0765-1

OPENSUSE-SU-2025:14811-1

OPENSUSE-SU-2025:14875-1

OPENSUSE-SU-2026:10286-1

OPENSUSE-SU-2026:10358-1

RHSA-2024:10806

RHSA-2024:1841

RHSA-2024:1846

RHSA-2024:2007

RHSA-2024:2113

RHSA-2024:2581

RHSA-2024:2584

RHSA-2024:2953

RHSA-2024:3431

RHSA-2024_2113

RHSA-2024_2953

RLSA-2024:2953

SUSE-SU-2024:0765-1

SUSE-SU-2024:0946-1

SUSE-SU-2024:1131-1

USN-6689-1

USN-6837-1

USN-6837-2

USN-7036-1

Affected Products

Almalinux

Astra Linux

Centos

Linuxmint

Rack

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 130

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26141.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml · Exploit
• https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9 · Patch
• https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b · Patch
• https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6689-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-27539 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26141 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0123 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-2953.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30123 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6837-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7036-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44572 · Security Note
• https://ubuntu.com/security/notices/USN-6837-2 · Vendor Advisory