CVE-2024-26141: Rack Web Server Interface DoS Vulnerability

CVE-2024-26141 Overview

CVE-2024-26141 is a denial of service vulnerability in Rack, the modular Ruby web server interface used by Rails and many other Ruby web frameworks. Carefully crafted HTTP Range headers cause the server to produce responses that are disproportionately large relative to the request. Applications using the Rack::File middleware or the Rack::Utils.byte_ranges method are affected, which includes most Rails applications serving static or ranged content. The vulnerability is tracked as [CWE-400] (Uncontrolled Resource Consumption) and is fixed in Rack 3.0.9.1 and 2.2.8.1.

Critical Impact
Unauthenticated attackers can send a single crafted Range header to force oversized responses, exhausting server bandwidth, memory, and processing capacity.

Affected Products

Rack (Ruby gem) versions prior to 2.2.8.1
Rack (Ruby gem) 3.0.x versions prior to 3.0.9.1
Debian GNU/Linux 10 (with affected Rack package)

Discovery Timeline

2024-02-29 - CVE-2024-26141 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26141

Vulnerability Analysis

The vulnerability resides in Rack::Utils.byte_ranges, the helper that parses HTTP Range request headers per RFC 7233. The function builds an array of Ruby Range objects representing the byte spans the client requests. Rack did not validate that the sum of requested byte spans was bounded by the size of the underlying resource. An attacker can supply many overlapping or oversized ranges in a single header, forcing the server to assemble and transmit a response significantly larger than the file itself.

When this parsed range list is fed to Rack::File or similar middleware, the server reads file content multiple times and pushes large multipart responses to the client. Repeated requests amplify CPU, memory, and outbound bandwidth consumption, producing a denial of service condition against the application or upstream load balancers.

Root Cause

The root cause is missing input validation on the cumulative size of parsed byte ranges. Rack::Utils.byte_ranges accepted any syntactically valid range set without comparing the total requested bytes against the resource size, violating the resource consumption boundary defined by [CWE-400].

Attack Vector

Exploitation requires only network access to an HTTP endpoint that returns ranged content. No authentication or user interaction is needed. An attacker sends a single GET request containing a Range header with many overlapping or large byte ranges (for example, Range: bytes=0-,0-,0-,0-,...), causing the server to emit a response that is several multiples of the underlying file size.

ruby

# Security patch in lib/rack/utils.rb
# Source: https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9
        end
        ranges << (r0..r1)  if r0 <= r1
      end
+
+      return [] if ranges.map(&:size).sum > size
+
      ranges
    end

The fix returns an empty range array whenever the cumulative size of all requested ranges exceeds the resource size, causing Rack to fall back to serving the full resource once rather than amplifying the response.

Detection Methods for CVE-2024-26141

Indicators of Compromise

HTTP requests containing Range headers with an unusually high number of comma-separated byte ranges
Range header values where the sum of requested byte spans exceeds the target file size
Sustained outbound bandwidth spikes from Ruby/Rails application servers without corresponding request volume increase
Repeated 206 Partial Content responses with multipart bodies far larger than the requested resource

Detection Strategies

Inspect web server and reverse proxy logs for Range headers containing more than a small number of byte ranges, particularly with overlapping spans
Compare response byte counts against the size of the resource being served; flag responses materially larger than the source file
Monitor Ruby process memory and CPU usage on hosts running Rack-based applications for anomalous spikes
Inventory installed Ruby gems and flag any rack version older than 2.2.8.1 or 3.0.9.1

Monitoring Recommendations

Alert on egress bandwidth anomalies from application servers behind reverse proxies
Add WAF rules that count comma-separated ranges in Range headers and block requests exceeding a low threshold
Track gem inventory in CI/CD pipelines and fail builds that pull vulnerable Rack versions
Correlate 206 responses with payload size to surface amplification patterns in SIEM dashboards

How to Mitigate CVE-2024-26141

Immediate Actions Required

Upgrade Rack to version 2.2.8.1 (2.x branch) or 3.0.9.1 (3.x branch) in all Ruby applications
Rebuild and redeploy container images and bundled Rails applications that pin a vulnerable Rack version
Apply Debian security updates referenced in the Debian LTS Announcement for affected systems
Review NetApp products via the NetApp Security Advisory NTAP-20240510-0007 for embedded Rack components

Patch Information

The fix is published in the GitHub Security Advisory GHSA-xj5v-6v4g-jfw6 and implemented across two commits: rack/rack@4849132 and rack/rack@6245768. Update Gemfile entries to gem 'rack', '~> 2.2.8.1' or gem 'rack', '~> 3.0.9.1' and run bundle update rack.

Workarounds

Strip or normalize incoming Range headers at the reverse proxy or CDN when upgrading Rack is not immediately feasible
Configure a WAF rule to reject requests where the Range header contains more than two byte ranges
Disable Rack::File middleware and serve static assets through a hardened web server such as Nginx if the application does not require ranged downloads

bash

# Nginx configuration example: drop Range headers with more than 2 ranges
map $http_range $safe_range {
    default                       $http_range;
    "~*,.*,"                      "";
}

server {
    location / {
        proxy_set_header Range $safe_range;
        proxy_pass http://rails_backend;
    }
}