CVE-2024-26146

rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · February 22, 2024

Updated · September 17, 2026

Description

A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Rack Header. Carefully crafted headers can cause header parsing in Rack to take longer than expected, resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is currently available for this vulnerability. The recommendation is to perform updates as soon as they are available.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1333 · Inefficient Regular Expression Complexity