Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-26146 EUVD-2024-0516GHSA-54rr-7fvw-6x8f

Possible Denial of Service Vulnerability in Rack Header Parsing

Published Feb 28, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: rack Product: rack Package: kube-fluentd-operator Package: kube-fluentd-operator-compat Package: kube-fluentd-operator-default-config Package: kube-fluentd-operator-oci-entrypoint Package: rack Package: ruby-rack Package: ruby-rack Package: ruby3.2-rack Package: ruby3.2-rack-2.2 Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Affected products

VendorProductAffectedFixed
rack rack >= 3.0.0, < 3.0.9.1, >= 2.2.0, < 2.2.8.1, >= 2.1.0, < 2.1.4.4, < 2.0.9.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 2.2.7-1.1 —
Debian 13 ruby-rack 2.2.7-1.1 —
Debian 12 ruby-rack 2.2.6.4-1+deb12u1 DSA-5698-1
Debian 11 ruby-rack 2.1.4-3+deb11u2 DSA-5698-1
Debian 10 ruby-rack 2.0.6-3+deb10u4 DLA-3800-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.1 USN-6837-1
Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.1 USN-7036-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-rack 2.1.4-5ubuntu1+esm5 USN-6837-2
Ubuntu Pro 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm5 USN-6837-2
Ubuntu Pro 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm6 USN-6837-2
Ubuntu Pro 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm6 USN-6837-2
Ubuntu Pro 14.04 LTS ruby-rack 1.5.2-3+deb8u3ubuntu1~esm8 USN-6837-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 pcs +1 0.11.7-2.el9_4 RHSA-2024:2113
RHEL 8 pcs +1 0.10.18-2.el8_10 RHSA-2024:2953
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 python-pulp-container +1 2.16.9-2.el8pc RHSA-2024:10806
Red Hat Satellite Capsule 6 rubygem-rack 2.2.8.1-1.el8sat RHSA-2024:10806
Red Hat Satellite 6 python-pulp-container +1 2.16.9-2.el8pc RHSA-2024:10806
Red Hat Satellite 6 rubygem-activestorage 6.1.7.7-1.el8sat RHSA-2024:10806
Red Hat Satellite 6 rubygem-rack 2.2.8.1-1.el8sat RHSA-2024:10806
RHEL 9.2 EUS pcs +1 0.11.4-7.el9_2.1 RHSA-2024:1846
RHEL 9.0 EUS pcs +1 0.11.1-10.el9_0.5 RHSA-2024:1841
RHEL 8.8 EUS pcs +1 0.10.15-4.el8_8.2 RHSA-2024:2581
RHEL 8.6 EUS pcs +1 0.10.12-6.el8_6.5 RHSA-2024:3431
RHEL 8.4 TUS pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.4 E4S pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.4 AUS pcs +1 0.10.8-1.el8_4.5 RHSA-2024:2584
RHEL 8.2 TUS pcs +1 0.10.4-6.el8_2.5 RHSA-2024:2007
RHEL 8.2 E4S pcs +1 0.10.4-6.el8_2.5 RHSA-2024:2007

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 pcs +1 0.11.7-2.el9_4 ALSA-2024:2113
AlmaLinux 8 pcs +1 0.10.18-2.el8_10 ALSA-2024:2953

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 pcs 0.10.18-2.el8_10 RLSA-2024:2953

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP4 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP3 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 15 SP2 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1
SLES 12 rubygem-rack-1_4 1.4.5-9.3.1 SUSE-SU-2024:0946-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-rack 1.6.13-3.22.1 SUSE-SU-2024:1131-1
SUSE OpenStack Cloud Crowbar 8 rubygem-rack 1.6.13-3.22.1 SUSE-SU-2024:1131-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rack 3.0.9.1-1.1 openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1, openSUSE-SU-2024:13726-1
openSUSE Tumbleweed rubygem-rack-2.2 2.2.8.1-1.1 openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14811-1, openSUSE-SU-2024:13727-1
openSUSE Leap 15.5 rubygem-rack 2.0.8-150000.3.21.2 SUSE-SU-2024:0765-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 pcs +1 0.9.169-3.amzn2.3.0.3 ALAS2-2024-2492

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 pcs +1 0.11.7-2.el9_4 ELSA-2024-2113
Oracle Linux 8 pcs +1 0.10.18-2.0.1.el8_10 ELSA-2024-2953

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kube-fluentd-operator +3 1.18.2-r3 —
Wolfi rolling ruby3.2-rack 3.0.9.1-r0 —
Wolfi rolling ruby3.2-rack-2.2 2.2.8.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack >= 3.0.0, < 3.0.9.1 3.0.9.1 GHSA-54rr-7fvw-6x8f
RubyGems rack >= 2.2.0, < 2.2.8.1 2.2.8.1 GHSA-54rr-7fvw-6x8f
RubyGems rack >= 2.1.0, < 2.1.4.4 2.1.4.4 GHSA-54rr-7fvw-6x8f
RubyGems rack < 2.0.9.4 2.0.9.4 GHSA-54rr-7fvw-6x8f

Advisories 30

References