Rack Header Parsing leads to Possible Denial of Service Vulnerability

🗓️ 28 Feb 2024 22:57:03Reported by GitHub Advisory DatabaseType

Possible Denial of Service Vulnerability in Rack Header Parsing. Impact on Accept and Forwarded headers. Ruby 3.2 has mitigations

Reporter	Title	Published	Views	Family All 172
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in rack-2.0.7.gem	15 Apr 202503:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in rack-2.0.7.gem	29 Apr 202416:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to Rack ( CVE-2024-26146 )	8 Aug 202420:07	–	ibm
Tenable Nessus	Amazon Linux 2 : pcs (ALAS-2024-2492)	18 Mar 202400:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0132: pcs (ALINUX3-SA-2024:0132)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : pcs (CESA-2024:2953)	22 May 202400:00	–	nessus
Tenable Nessus	Debian dla-3800 : ruby-rack - security update	29 Apr 202400:00	–	nessus
Tenable Nessus	Debian dsa-5698 : ruby-rack - security update	24 May 202400:00	–	nessus
Tenable Nessus	Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)	16 Jul 202500:00	–	nessus
Tenable Nessus	Fedora 41 : rubygem-rack (2025-a35addbf9b)	12 Nov 202500:00	–	nessus

Vulners

Node

rack_project rackRange<2.0.9.4rubygems

rack_project rackRange2.1.0–2.1.4.4rubygems

rack_project rackRange2.2.0–2.2.8.1rubygems

rack_project rackRange3.0.0–3.0.9.1rubygems

Source	Link
github	www.github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
github	www.github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
github	www.github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
github	www.github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
github	www.github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
discuss	www.discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-26146
github	www.github.com/advisories/GHSA-54rr-7fvw-6x8f

18 Mar 2026 05:07Current

7High risk

Vulners AI Score7

CVSS 3.15.3 - 7.5

EPSS0.00775

SSVC