Possible Denial of Service Vulnerability in Rack Header Parsing
CVE-2024-26146
7.5HIGH
What is CVE-2024-26146?
A vulnerability within the Rack modular Ruby web server interface allows crafted headers to induce longer-than-expected header parsing durations, potentially leading to denial of service conditions. The vulnerability specifically affects Accept and Forwarded headers in certain versions of the Rack framework. Mitigations have been included in Ruby 3.2 and later, ensuring that applications utilizing these versions remain secure. The vulnerability has been addressed in Rack versions 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Affected Version(s)
rack >= 3.0.0, < 3.0.9.1 < 3.0.0, 3.0.9.1
rack >= 2.2.0, < 2.2.8.1 < 2.2.0, 2.2.8.1
rack >= 2.1.0, < 2.1.4.4 < 2.1.0, 2.1.4.4
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published