CVE-2024-26141
Fixed in a distro release EPSS 2%CVSS 5.8
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
Products: Rack, rack_project rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 3.0.9.1 |
| RubyGems | rack | 2.2.8.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | pcs | 0.10.18-2.el8_10 |
| AlmaLinux 8 | pcs-snmp | 0.10.18-2.el8_10 |
| AlmaLinux 9 | pcs | 0.11.7-2.el9_4 |
| AlmaLinux 9 | pcs-snmp | 0.11.7-2.el9_4 |
| Chainguard | kube-fluentd-operator | 1.18.2-r3 |
| Chainguard | kube-fluentd-operator-compat | 1.18.2-r3 |
| Chainguard | kube-fluentd-operator-default-config | 1.18.2-r3 |
| Chainguard | kube-fluentd-operator-oci-entrypoint | 1.18.2-r3 |
| Chainguard | logstash | 8.12.2-r2 |
| Chainguard | logstash-compat | 8.12.2-r2 |
| Chainguard | logstash-env2yaml | 8.12.2-r2 |
| Chainguard | logstash-jre-bcfips | 8.13.2-r0 |
| Chainguard | logstash-jre-bcfips-compat | 8.13.2-r0 |
| Chainguard | logstash-jre-bcfips-env2yaml | 8.13.2-r0 |
| Chainguard | logstash-jre-bcfips-with-output-opensearch | 8.13.2-r0 |
| Chainguard | logstash-with-output-opensearch | 8.12.2-r2 |
| Chainguard | ruby3.2-rack | 3.0.9.1-r0 |
| Chainguard | ruby3.2-rack-2.2 | 2.2.8.1-r0 |
| Debian 10 | ruby-rack | 2.0.6-3+deb10u4 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u2 |
| Debian 12 | ruby-rack | 2.2.6.4-1+deb12u1 |
| Debian 13 | ruby-rack | 2.2.7-1.1 |
| Debian 14 | ruby-rack | 2.2.7-1.1 |
| Red Hat Enterprise Linux 8 | pcs | 0:0.10.18-2.el8_10 |
| Red Hat Enterprise Linux 8 | pcs-snmp | 0:0.10.18-2.el8_10 |
| Red Hat Enterprise Linux 9 | pcs | 0:0.11.7-2.el9_4 |
| Red Hat Enterprise Linux 9 | pcs-snmp | 0:0.11.7-2.el9_4 |
| Red Hat rhel aus 8.4 | pcs | 0:0.10.8-1.el8_4.5 |
| Red Hat rhel aus 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.5 |
| Red Hat rhel e4s 8.2 | pcs | 0:0.10.4-6.el8_2.5 |
| Red Hat rhel e4s 8.2 | pcs-snmp | 0:0.10.4-6.el8_2.5 |
| Red Hat rhel e4s 8.4 | pcs | 0:0.10.8-1.el8_4.5 |
| Red Hat rhel e4s 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.5 |
| Red Hat rhel eus 8.6 | pcs | 0:0.10.12-6.el8_6.5 |
| Red Hat rhel eus 8.6 | pcs-snmp | 0:0.10.12-6.el8_6.5 |
| Red Hat rhel eus 8.8 | pcs | 0:0.10.15-4.el8_8.2 |
| Red Hat rhel eus 8.8 | pcs-snmp | 0:0.10.15-4.el8_8.2 |
| Red Hat rhel eus 9.0 | pcs | 0:0.11.1-10.el9_0.5 |
| Red Hat rhel eus 9.0 | pcs-snmp | 0:0.11.1-10.el9_0.5 |
| Red Hat rhel eus 9.2 | pcs | 0:0.11.4-7.el9_2.1 |
| Red Hat rhel eus 9.2 | pcs-snmp | 0:0.11.4-7.el9_2.1 |
| Red Hat rhel tus 8.2 | pcs | 0:0.10.4-6.el8_2.5 |
| Red Hat rhel tus 8.2 | pcs-snmp | 0:0.10.4-6.el8_2.5 |
| Red Hat rhel tus 8.4 | pcs | 0:0.10.8-1.el8_4.5 |
| Red Hat rhel tus 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.5 |
| Red Hat satellite 6.15 | python-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite 6.15 | python3.11-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite 6.15 | rubygem-activestorage | 0:6.1.7.7-1.el8sat |
| Red Hat satellite 6.15 | rubygem-rack | 0:2.2.8.1-1.el8sat |
| Red Hat satellite capsule 6.15 | python-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pulp-container | 0:2.16.9-2.el8pc |
| Red Hat satellite capsule 6.15 | rubygem-rack | 0:2.2.8.1-1.el8sat |
| Rocky Linux 8 | pcs | 0:0.10.18-2.el8_10 |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | rubygem-rack | 2.0.8-150000.3.21.2 |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | rubygem-rack | 2.0.8-150000.3.21.2 |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | rubygem-rack | 2.0.8-150000.3.21.2 |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | rubygem-rack | 2.0.8-150000.3.21.2 |
| SUSE Linux Enterprise Module for Containers 12 | rubygem-rack-1_4 | 1.4.5-9.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-rack | 1.6.13-3.22.1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-rack | 1.6.13-3.22.1 |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.1 |
| Ubuntu 23.10 | ruby-rack | 2.2.4-3ubuntu0.1 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm8 |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm6 |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm6 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm5 |
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1+esm5 |
| Wolfi | kube-fluentd-operator | 1.18.2-r3 |
| Wolfi | kube-fluentd-operator-compat | 1.18.2-r3 |
| Wolfi | kube-fluentd-operator-default-config | 1.18.2-r3 |
| Wolfi | kube-fluentd-operator-oci-entrypoint | 1.18.2-r3 |
| Wolfi | logstash | 8.12.2-r2 |
| Wolfi | logstash-compat | 8.12.2-r2 |
| Wolfi | logstash-env2yaml | 8.12.2-r2 |
| Wolfi | logstash-with-output-opensearch | 8.12.2-r2 |
| Wolfi | ruby3.2-rack | 3.0.9.1-r0 |
| Wolfi | ruby3.2-rack-2.2 | 2.2.8.1-r0 |
| openSUSE Leap 15.5 | rubygem-rack | 2.0.8-150000.3.21.2 |
| openSUSE Tumbleweed | rubygem-rack | 3.0.9.1-1.1 |
| openSUSE Tumbleweed | rubygem-rack | 3.1.12-1.1 |
| openSUSE Tumbleweed | rubygem-rack | 3.1.18-1.3 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.22-1.1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.8.1-1.1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.11-1.1 |