VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Feb 28, 2024· Updated Feb 13, 2025

Possible DoS Vulnerability with Range Header in Rack

CVE-2024-26141

Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rackRubyGems
>= 3.0.0, < 3.0.9.13.0.9.1
rackRubyGems
>= 1.3.0, < 2.2.8.12.2.8.1

Affected products

1

Patches

2
62457686b26d

Return an empty array when ranges are too large

https://github.com/rack/rackAaron PattersonFeb 13, 2024via ghsa
commit
2 files changed · +7 −0
  • lib/rack/utils.rb+3 −0 modified
    @@ -380,6 +380,9 @@ def get_byte_ranges(http_range, size)
         end
         ranges << (r0..r1)  if r0 <= r1
       end
+
+      return [] if ranges.map(&:size).sum > size
+
       ranges
     end
  • test/spec_utils.rb+4 −0 modified
    @@ -590,6 +590,10 @@ def initialize(*)
 end
 
 describe Rack::Utils, "byte_range" do
+  it "returns an empty list if the sum of the ranges is too large" do
+    assert_equal [], Rack::Utils.byte_ranges({ "HTTP_RANGE" => "bytes=0-20,0-500" }, 500)
+  end
+
   it "ignore missing or syntactically invalid byte ranges" do
     Rack::Utils.byte_ranges({}, 500).must_be_nil
     Rack::Utils.byte_ranges({ "HTTP_RANGE" => "foobar" }, 500).must_be_nil
4849132bef47

Return an empty array when ranges are too large

https://github.com/rack/rackAaron PattersonFeb 13, 2024via ghsa
commit
2 files changed · +7 −0
  • lib/rack/utils.rb+3 −0 modified
    @@ -459,6 +459,9 @@ def get_byte_ranges(http_range, size)
         end
         ranges << (r0..r1)  if r0 <= r1
       end
+
+      return [] if ranges.map(&:size).sum > size
+
       ranges
     end
  • test/spec_utils.rb+4 −0 modified
    @@ -716,6 +716,10 @@ def initialize(*)
 end
 
 describe Rack::Utils, "get_byte_ranges" do
+  it "returns an empty list if the sum of the ranges is too large" do
+    assert_equal [], Rack::Utils.byte_ranges({ "HTTP_RANGE" => "bytes=0-20,0-500" }, 500)
+  end
+
   deprecated "pase simple byte ranges from env" do
     Rack::Utils.byte_ranges({ "HTTP_RANGE" => "bytes=123-456" }, 500).must_equal [(123..456)]
   end

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.