Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rack | Rack | 0.4 (including) | 2.0.9.4 (excluding) |
| Rack | Rack | 2.1.0 (including) | 2.1.4.4 (excluding) |
| Rack | Rack | 2.2.0 (including) | 2.2.8.1 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | pcs-0:0.10.18-2.el8_10 | * |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service | RedHat | pcs-0:0.10.4-6.el8_2.5 | * |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | RedHat | pcs-0:0.10.4-6.el8_2.5 | * |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | RedHat | pcs-0:0.10.8-1.el8_4.5 | * |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | RedHat | pcs-0:0.10.8-1.el8_4.5 | * |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | RedHat | pcs-0:0.10.8-1.el8_4.5 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | pcs-0:0.10.12-6.el8_6.5 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | pcs-0:0.10.15-4.el8_8.2 | * |
| Red Hat Enterprise Linux 9 | RedHat | pcs-0:0.11.7-2.el9_4 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | pcs-0:0.11.1-10.el9_0.5 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | pcs-0:0.11.4-7.el9_2.1 | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | rubygem-rack-0:2.2.8.1-1.el8sat | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | rubygem-rack-0:2.2.8.1-1.el8sat | * |
| Ruby-rack | Ubuntu | bionic | * |
| Ruby-rack | Ubuntu | esm-apps-legacy/xenial | * |
| Ruby-rack | Ubuntu | esm-apps/bionic | * |
| Ruby-rack | Ubuntu | esm-apps/focal | * |
| Ruby-rack | Ubuntu | esm-apps/jammy | * |
| Ruby-rack | Ubuntu | esm-apps/xenial | * |
| Ruby-rack | Ubuntu | esm-infra-legacy/trusty | * |
| Ruby-rack | Ubuntu | focal | * |
| Ruby-rack | Ubuntu | jammy | * |
| Ruby-rack | Ubuntu | mantic | * |
| Ruby-rack | Ubuntu | noble | * |
| Ruby-rack | Ubuntu | trusty | * |
| Ruby-rack | Ubuntu | trusty/esm | * |
| Ruby-rack | Ubuntu | upstream | * |
| Ruby-rack | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
References
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0006/
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0006/