CVE-2024-26141

Name of the Vulnerable Software and Affected Versions Rack versions 1.3.0 through 3.0.9 and 2.2.8.1.

Description Rack is a modular Ruby web server interface. A denial of service (DoS) vulnerability exists due to improper handling of Range headers. Carefully crafted Range headers can cause the server to respond with an unexpectedly large response, potentially leading to a denial of service. Applications using the Rack::File middleware or the Rack::Utils.byte ranges methods, including Rails applications, are vulnerable.

Recommendations Upgrade to Rack version 3.0.9.1 or 2.2.8.1 to address this vulnerability.