CVE-2024-26141

rubygem-rack: Possible DoS Vulnerability with Range Header in Rack

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · February 22, 2024

Updated · September 17, 2026

Description

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Range Header. Carefully crafted range headers can cause a server to respond with an unexpectedly large response. Responding with large responses could lead to a denial of service issue.

Statement

Red Hat rates this vulnerability as a Moderate impact as this requires a specifically crafted response.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is currently available for this vulnerability. The recommendation is to perform updates as soon as they are available.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1333 · Inefficient Regular Expression Complexity