Skip to content
OpenAdvisories
Medium · 5.8 CVE-2024-26141 EUVD-2024-0768GHSA-xj5v-6v4g-jfw6

Possible DoS Vulnerability with Range Header in Rack

Published Feb 28, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: rack Product: rack Package: kube-fluentd-operator Package: kube-fluentd-operator-compat Package: kube-fluentd-operator-default-config Package: kube-fluentd-operator-oci-entrypoint Package: rack Package: ruby-rack Package: ruby-rack Package: ruby3.2-rack Package: ruby3.2-rack-2.2 Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Affected products

VendorProductAffectedFixed
rack rack >= 3.0.0, < 3.0.9.1, >= 1.3.0, < 2.2.8.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 2.2.7-1.1 —
Debian 13 ruby-rack 2.2.7-1.1 —
Debian 12 ruby-rack 2.2.6.4-1+deb12u1 DSA-5698-1
Debian 11 ruby-rack 2.1.4-3+deb11u2 DSA-5698-1
Debian 10 ruby-rack 2.0.6-3+deb10u4 DLA-3800-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.1 USN-6837-1
Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.1 USN-7036-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-rack 2.1.4-5ubuntu1+esm5 USN-6837-2
Ubuntu Pro 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm5 USN-6837-2
Ubuntu Pro 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm6 USN-6837-2
Ubuntu Pro 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm6 USN-6837-2
Ubuntu Pro 14.04 LTS ruby-rack 1.5.2-3+deb8u3ubuntu1~esm8 USN-6837-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 pcs +1 0.11.7-2.el9_4 RHSA-2024:2113
RHEL 8 pcs +1 0.10.18-2.el8_10 RHSA-2024:2953
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 python-pulp-container +1 2.16.9-2.el8pc RHSA-2024:10806
Red Hat Satellite Capsule 6 rubygem-rack 2.2.8.1-1.el8sat RHSA-2024:10806
Red Hat Satellite 6 python-pulp-container +1 2.16.9-2.el8pc RHSA-2024:10806
Red Hat Satellite 6 rubygem-activestorage 6.1.7.7-1.el8sat RHSA-2024:10806
Red Hat Satellite 6 rubygem-rack 2.2.8.1-1.el8sat RHSA-2024:10806
RHEL 9.2 EUS pcs +1 0.11.4-7.el9_2.1 RHSA-2024:1846
RHEL 9.0 EUS pcs +1 0.11.1-10.el9_0.5 RHSA-2024:1841
RHEL 8.8 EUS pcs +1 0.10.15-4.el8_8.2 RHSA-2024:2581
RHEL 8.6 EUS pcs +1 0.10.12-6.el8_6.5 RHSA-2024:3431
RHEL 8.4 TUS pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.4 E4S pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.4 AUS pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.2 TUS pcs +1 0.10.4-6.el8_2.5 RHSA-2024:2007
RHEL 8.2 E4S pcs +1 0.10.4-6.el8_2.5 RHSA-2024:2007

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 pcs +1 0.11.7-2.el9_4 ALSA-2024:2113
AlmaLinux 8 pcs +1 0.10.18-2.el8_10 ALSA-2024:2953

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 pcs 0.10.18-2.el8_10 RLSA-2024:2953

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP4 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP3 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP2 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 12 rubygem-rack-1_4 1.4.5-9.3.1 SUSE-SU-2024:0946-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-rack 1.6.13-3.22.1 SUSE-SU-2024:1131-1
SUSE OpenStack Cloud Crowbar 8 rubygem-rack 1.6.13-3.22.1 SUSE-SU-2024:1131-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rack 3.0.9.1-1.1 openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1
openSUSE Tumbleweed rubygem-rack-2.2 2.2.8.1-1.1 openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1
openSUSE Leap 15.5 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 pcs +1 0.9.169-3.amzn2.3.0.3 ALAS2-2024-2492

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 pcs +1 0.11.7-2.el9_4 ELSA-2024-2113
Oracle Linux 8 pcs +1 0.10.18-2.0.1.el8_10 ELSA-2024-2953

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kube-fluentd-operator +3 1.18.2-r3 —
Wolfi rolling ruby3.2-rack 3.0.9.1-r0 —
Wolfi rolling ruby3.2-rack-2.2 2.2.8.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack >= 3.0.0, < 3.0.9.1 3.0.9.1 GHSA-xj5v-6v4g-jfw6
RubyGems rack >= 1.3.0, < 2.2.8.1 2.2.8.1 GHSA-xj5v-6v4g-jfw6

Advisories 31

References