Rack has possible DoS Vulnerability with Range Header (CVE-2024-26141)

Rack has possible DoS Vulnerability with Range Header (CVE-2024-26141) | HOL Guard CVE

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps rack (rubygems), rack (rubygems). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
rackrubygems	>=3.0.0 <3.0.9.1	3.0.9.1
rackrubygems	>=1.3.0 <2.2.8.1	2.2.8.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for rack, rack.
Review the reported fix. Update rack to 3.0.9.1; rack to 2.2.8.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Feb 28, 2024
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

# Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 3-0-range.patch - Patch for 3.0 series * 2-2-range.patch - Patch for 2.2 series Credits ------- Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and patch

Quoted source text, attributed separately from HOL analysis.