CVE-2024-26146

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

• CWE-1333
• CWE-1333

• https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942Vendor Advisory
• https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716Patch
• https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582Patch
• https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6fPatch
• https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccdPatch
• https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8fVendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.ymlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00022.htmlMailing List
• https://security.netapp.com/advisory/ntap-20240510-0006/Third Party Advisory
• https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942Vendor Advisory
• https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716Patch
• https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582Patch
• https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6fPatch
• https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccdPatch
• https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8fVendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.ymlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00022.htmlMailing List
• https://security.netapp.com/advisory/ntap-20240510-0006/Third Party Advisory

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26140com.yetanalytics/lrs is the Yet Analytics Core LRS Library. …6.1
• CVE-2024-26141Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-26142Rails is a web-application framework. Starting in version 7.…7.5
• CVE-2024-26143Rails is a web-application framework. There is a possible XS…6.1
• CVE-2024-26144Rails is a web-application framework. Starting with version …5.3
• CVE-2024-26145Discourse Calendar adds the ability to create a dynamic cale…4.3
• CVE-2024-26147Helm is a package manager for Charts for Kubernetes. Version…7.5
• CVE-2024-26148Querybook is a user interface for querying big data. Prior t…6.1
• CVE-2024-26149Vyper is a pythonic Smart Contract Language for the ethereum…5.3
• CVE-2024-2615Memory safety bugs present in Firefox 123. Some of these bug…9.8
• CVE-2024-26150`@backstage/backend-common` is a common functionality librar…7.5
• CVE-2024-26151The `mjml` PyPI package, found at the `FelixSchwarz/mjml-pyt…5.4