CVE-2024-26141 - CVE House
Back to Database
Status published Medium CVE-2024-26141

Possible DoS Vulnerability with Range Header in Rack

Vulnerability Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-26141

Credits & Attribution

No credits recorded in the NVD database.

References

More from rack

View All →
CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
High 7.5
CVE-2025-61780
Rack has Possible Information Disclosure Vulnerability
Medium 5.8
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
High 7.5
CVE-2025-61771
Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
High 7.5
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
High 7.5

Affected Vendor

Affected Software

rack
Vulnerable Versions:
>= 3.0.0, < 3.0.9.1, >= 1.3.0, < 2.2.8.1

Timeline

Official Publish: February 28th, 2024
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact