Debian Security Bug TrackerDEBIANCVE:CVE-2024-26146CVE-2024-26146
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0.0004 Low
EPSS
Percentile
13.1%
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | ruby-rack | < 2.2.6.4-1+deb12u1 | ruby-rack_2.2.6.4-1+deb12u1_all.deb |
| Debian | 11 | all | ruby-rack | < 2.1.4-3+deb11u2 | ruby-rack_2.1.4-3+deb11u2_all.deb |
| Debian | 10 | all | ruby-rack | < 2.0.6-3+deb10u4 | ruby-rack_2.0.6-3+deb10u4_all.deb |
| Debian | 999 | all | ruby-rack | < 2.2.7-1.1 | ruby-rack_2.2.7-1.1_all.deb |
| Debian | 13 | all | ruby-rack | < 2.2.7-1.1 | ruby-rack_2.2.7-1.1_all.deb |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
0.0004 Low
EPSS
Percentile
13.1%