CVE-2024-26141.yml

---
gem: rack
cve: 2024-26141
ghsa: xj5v-6v4g-jfw6
url: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
title: Possible DoS Vulnerability with Range Header in Rack
date: 2024-02-21
description: |
  There is a possible DoS vulnerability relating to the Range request header in
  Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

  Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

  # Impact

  Carefully crafted Range headers can cause a server to respond with an
  unexpectedly large response. Responding with such large responses could lead
  to a denial of service issue.

  Vulnerable applications will use the `Rack::File` middleware or the
  `Rack::Utils.byte_ranges` methods (this includes Rails applications).

  # Releases

  The fixed releases are available at the normal locations.

  # Workarounds

  There are no feasible workarounds for this issue.
unaffected_versions:
  - "< 1.3.0"
patched_versions:
  - "~> 2.2.8, >= 2.2.8.1"
  - ">= 3.0.9.1"
related:
  url:
    - https://github.com/rack/rack/releases/tag/v3.0.9.1
    - https://github.com/rack/rack/releases/tag/v2.2.8.1
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25141
    - https://access.redhat.com/security/cve/cve-2024-26141
    - https://ubuntu.com/security/CVE-2024-26141