7.5

CVE-2024-26141: Possible DoS Vulnerability with Range Header in Rack

Analyzed
AliasesUBUNTU-CVE-2024-26141DEBIAN-CVE-2024-26141CGA-296c-7r2f-c338
Published 28-02-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-26141 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 1.61% chance of exploitation in the next 30 days, higher than 75.9% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Routine

Not severe (CVSS 5.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
1.61%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3github, reference

Advisory lineage

Upstream 0 · Downstream 24 · Related 19
DLA-3800-1DSA-5698-1MGASA-2024-0123OPENSUSE-SU-2024:13726-1OPENSUSE-SU-2024:13727-1OPENSUSE-SU-2025:14811-1

Timeline

  1. 28-02-2024
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.61%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.61% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found
  • githubUnverified

    Rack

    Maturity: poc

  • githubUnverified

    Ruby Advisory Db

    Maturity: poc

  • referenceUnverified

    Exploit Reference (discuss.rubyonrails.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard6 products
  • kube-fluentd-operator< 1.18.2-r3
  • kube-fluentd-operator-compat< 1.18.2-r3
  • kube-fluentd-operator-default-config< 1.18.2-r3
  • kube-fluentd-operator-oci-entrypoint< 1.18.2-r3
  • ruby3.2-rack< 3.0.9.1-r0
Wolfi6 products
  • kube-fluentd-operator< 1.18.2-r3
  • kube-fluentd-operator-compat< 1.18.2-r3
  • kube-fluentd-operator-default-config< 1.18.2-r3
  • kube-fluentd-operator-oci-entrypoint< 1.18.2-r3
  • ruby3.2-rack< 3.0.9.1-r0
Debian2 products
  • ruby-rack< 2.2.6.4-1+deb12u1 | < 2.2.7-1.1
  • debian_linuxEOL10.0
Rack1 product
  • rack≥ 1.3.0, < 2.2.8.1 | ≥ 3.0.0, < 3.0.9.1
RubyGems1 product
  • rack≥ 3.0.0, < 3.0.9.1 | ≥ 1.3.0, < 2.2.8.1
Ubuntu1 product
  • ruby-rack< 1.5.2-3+deb8u3ubuntu1~esm8 | < 1.6.4-3ubuntu0.2+esm6 | < 1.6.4-4ubuntu0.2+esm6 | < 2.0.7-2ubuntu0.1+esm5 | < 2.1.4-5ubuntu1.1 | < 2.1.4-5ubuntu1+esm5 | < 2.2.7-1ubuntu0.1

6 vendors · 17 products

References

18 links
Show all 18 references