CVE-2024-26141

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncontrolled Resource Consumption pada rack, debian linux. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Rincian

Terbit di NVD

29 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944 exploit · advisory vendor
• https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6 exploit · advisory vendor
• https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9 patch
• https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b patch
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml exploit · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240510-0007/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html mailing list