UBUNTU-CVE-2024-26141
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
02 / AFFECTED SOFTWARE
Affected packages
4 explicit affected versions
2 explicit affected versions
7 explicit affected versions
9 explicit affected versions
7 explicit affected versions
7 explicit affected versions
7 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
05 / REFERENCES
Further evidence
- https://github.com/rack/rack/releases/tag/v2.2.8.1
- https://ubuntu.com/security/CVE-2024-26141
- https://ubuntu.com/security/notices/USN-6689-1
- https://ubuntu.com/security/notices/USN-6837-1
- https://ubuntu.com/security/notices/USN-6837-2
- https://ubuntu.com/security/notices/USN-7036-1
- https://www.cve.org/CVERecord?id=CVE-2024-26141