Possible Denial of Service Vulnerability in Rack Header Parsing
Priority MEDIUM 43CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01996 80th percentileScored 2026-11-07
Fix Partial rack (rack): 3.0.9.1, 2.2.8.1, 2.1.4.4 +1rack (RubyGems): 3.0.9.1, 2.2.8.1, 2.1.4.4 +1Red Hat: 9 advisoriesRed Hat: 18 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rack | rack | 3.0.0 to before 3.0.9.1; 2.2.0 to before 2.2.8.1; 2.1.0 to before 2.1.4.4; before 2.0.9.4 | 3.0.9.1, 2.2.8.1, 2.1.4.4, 2.0.9.4 | Patch available | CNA |
| — | rack (RubyGems) | 3.0.0 to before 3.0.9.1 | 3.0.9.1 | Patch available | GHSA-54rr-7fvw-6x8f |
| — | rack (RubyGems) | 2.2.0 to before 2.2.8.1 | 2.2.8.1 | Patch available | GHSA-54rr-7fvw-6x8f |
| — | rack (RubyGems) | 2.1.0 to before 2.1.4.4 | 2.1.4.4 | Patch available | GHSA-54rr-7fvw-6x8f |
| — | rack (RubyGems) | before 2.0.9.4 | 2.0.9.4 | Patch available | GHSA-54rr-7fvw-6x8f |
- rack Vendorrack Affected 3.0.0 to before 3.0.9.1; 2.2.0 to before 2.2.8.1; 2.1.0 to before 2.1.4.4; before 2.0.9.4 Fixed in 3.0.9.1, 2.2.8.1, 2.1.4.4, 2.0.9.4 Patch available CNA
- rack (RubyGems) Vendor— Affected 3.0.0 to before 3.0.9.1 Fixed in 3.0.9.1 Patch available GHSA-54rr-7fvw-6x8f
- rack (RubyGems) Vendor— Affected 2.2.0 to before 2.2.8.1 Fixed in 2.2.8.1 Patch available GHSA-54rr-7fvw-6x8f
- rack (RubyGems) Vendor— Affected 2.1.0 to before 2.1.4.4 Fixed in 2.1.4.4 Patch available GHSA-54rr-7fvw-6x8f
- rack (RubyGems) Vendor— Affected before 2.0.9.4 Fixed in 2.0.9.4 Patch available GHSA-54rr-7fvw-6x8f
Remediation
- Fix · CNA rack (rack) Fixed in 3.0.9.1, 2.2.8.1, 2.1.4.4, 2.0.9.4
- Fix · GHSA-54rr-7fvw-6x8f rack (RubyGems) Fixed in 3.0.9.1 Advisory →
- Fix · GHSA-54rr-7fvw-6x8f rack (RubyGems) Fixed in 2.2.8.1 Advisory →
- Fix · GHSA-54rr-7fvw-6x8f rack (RubyGems) Fixed in 2.1.4.4 Advisory →
- Fix · GHSA-54rr-7fvw-6x8f rack (RubyGems) Fixed in 2.0.9.4 Advisory →
Red Hat 9 advisories
- RHSA-2024:10806 Released 2024-12-04 · Red Hat rating ModerateSatellite 6.15.5 Async Update
- Red Hat Satellite 6.15 for RHEL 8 python-pulp-container-2.16.9-2.el8pc, python3.11-pulp-container-2.16.9-2.el8pc, rubygem-activestorage-6.1.7.7-1.el8sat +1
- RHSA-2024:3431 Released 2024-05-28 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability EUS (v.8.6) pcs-0.10.12-6.el8_6.5, pcs-snmp-0.10.12-6.el8_6.5
- Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) pcs-0.10.12-6.el8_6.5, pcs-snmp-0.10.12-6.el8_6.5
- RHSA-2024:2953 Released 2024-05-22 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10, pcs-snmp-0.10.18-2.el8_10
- Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10, pcs-snmp-0.10.18-2.el8_10
Show 6 more Red Hat advisories
- RHSA-2024:2584 Released 2024-04-30 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
- Red Hat Enterprise Linux HighAvailability E4S (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
- Red Hat Enterprise Linux HighAvailability TUS (v.8.4) pcs-0.10.8-1.el8_4.5, pcs-snmp-0.10.8-1.el8_4.5
- RHSA-2024:2581 Released 2024-04-30 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability EUS (v.8.8) pcs-0.10.15-4.el8_8.2, pcs-snmp-0.10.15-4.el8_8.2
- Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) pcs-0.10.15-4.el8_8.2, pcs-snmp-0.10.15-4.el8_8.2
- RHSA-2024:2113 Released 2024-04-30 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux HighAvailability (v. 9) pcs-0.11.7-2.el9_4, pcs-snmp-0.11.7-2.el9_4
- Red Hat Enterprise Linux ResilientStorage (v. 9) pcs-0.11.7-2.el9_4, pcs-snmp-0.11.7-2.el9_4
- RHSA-2024:2007 Released 2024-04-23 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability E4S (v. 8.2) pcs-0.10.4-6.el8_2.5, pcs-snmp-0.10.4-6.el8_2.5
- Red Hat Enterprise Linux High Availability TUS (v. 8.2) pcs-0.10.4-6.el8_2.5, pcs-snmp-0.10.4-6.el8_2.5
- RHSA-2024:1846 Released 2024-04-16 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs-0.11.4-7.el9_2.1, pcs-snmp-0.11.4-7.el9_2.1
- Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs-0.11.4-7.el9_2.1, pcs-snmp-0.11.4-7.el9_2.1
- RHSA-2024:1841 Released 2024-04-16 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux High Availability EUS (v.9.0) pcs-0.11.1-10.el9_0.5, pcs-snmp-0.11.1-10.el9_0.5
- Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) pcs-0.11.1-10.el9_0.5, pcs-snmp-0.11.1-10.el9_0.5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2024:2584 |
| Red Hat Enterprise Linux High Availability E4S (v. 8.2) | Fixed | RHSA-2024:2007 |
| Red Hat Enterprise Linux High Availability EUS (v.8.6) | Fixed | RHSA-2024:3431 |
| Red Hat Enterprise Linux High Availability EUS (v.8.8) | Fixed | RHSA-2024:2581 |
| Red Hat Enterprise Linux High Availability EUS (v.9.0) | Fixed | RHSA-2024:1841 |
| Red Hat Enterprise Linux High Availability EUS (v.9.2) | Fixed | RHSA-2024:1846 |
| Red Hat Enterprise Linux High Availability TUS (v. 8.2) | Fixed | RHSA-2024:2007 |
| Red Hat Enterprise Linux HighAvailability (v. 8) | Fixed | RHSA-2024:2953 |
| Red Hat Enterprise Linux HighAvailability (v. 9) | Fixed | RHSA-2024:2113 |
| Red Hat Enterprise Linux HighAvailability E4S (v.8.4) | Fixed | RHSA-2024:2584 |
| Red Hat Enterprise Linux HighAvailability TUS (v.8.4) | Fixed | RHSA-2024:2584 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) | Fixed | RHSA-2024:3431 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) | Fixed | RHSA-2024:2581 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) | Fixed | RHSA-2024:1841 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) | Fixed | RHSA-2024:1846 |
| Red Hat Enterprise Linux ResilientStorage (v. 8) | Fixed | RHSA-2024:2953 |
| Red Hat Enterprise Linux ResilientStorage (v. 9) | Fixed | RHSA-2024:2113 |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2024:10806 |
Not affected: 2 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Satellite 6.15 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-26146
- 2026-10-03 Alias added: GHSA-54rr-7fvw-6x8f
References
Patch 4
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
Advisory 5
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
- https://security.netapp.com/advisory/ntap-20240510-0006/
- https://nvd.nist.gov/vuln/detail/CVE-2024-26146
More Rack vulnerabilities
- TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
- TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
- TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
- TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
- TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
- TI-2025-29398 Unbounded-Parameter DoS in Rack::QueryParser CVSS 3.1HIGH 7.5
Sources
- CVE-2024-26146 · CVE Program
- CVE-2024-26146 · NVD
- FIRST EPSS
- GHSA-54rr-7fvw-6x8f · GitHub Advisory Database · CC BY 4.0
- CVE-2024-26146 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences