Ubuntu.comUB:CVE-2024-26146CVE-2024-26146
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.1%
Rack is a modular Ruby web server interface. Carefully crafted headers can
cause header parsing in Rack to take longer than expected resulting in a
possible denial of service issue. Accept and Forwarded headers are
impacted. Ruby 3.2 has mitigations for this problem, so Rack applications
using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in
2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | ruby-rack | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | ruby-rack | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | ruby-rack | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | ruby-rack | < 2.2.4-3ubuntu0.1 | UNKNOWN |
| ubuntu | 24.04 | noarch | ruby-rack | < 2.2.7-1ubuntu0.1 | UNKNOWN |
| ubuntu | 14.04 | noarch | ruby-rack | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | ruby-rack | < any | UNKNOWN |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
13.1%