CVE-2024-26146
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
- Affected products
- Almalinux, Astra Linux, Centos, Linuxmint, Rack, Red Hat, Red Os, Rocky Linux
- Rack
- < 2.0.9.4, 2.1.4.4, 2.2.8.1
- Fix
- Available
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 2.0% (79th percentile)
- Weakness
- CWE-1333
- NVD status
- Analyzed
- Published
- 2024-02-28
CVE-2024-26146 at NVD
No indexed exploits for CVE-2024-26146 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-26146 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.