CVE-2024-26146 Overview
CVE-2024-26146 is a denial of service vulnerability in Rack, the modular Ruby web server interface used by Rails and other Ruby web frameworks. Carefully crafted HTTP Accept and Forwarded headers cause Rack's header parsing routines to take significantly longer than expected. The flaw is categorized as inefficient regular expression complexity [CWE-1333], allowing remote unauthenticated attackers to consume server CPU resources. Ruby 3.2 includes mitigations that neutralize the issue, so applications running on Ruby 3.2 or newer are unaffected. The vulnerability is fixed in Rack versions 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
Critical Impact
Remote unauthenticated attackers can degrade or disable Rack-based Ruby web applications by sending malformed Accept or Forwarded headers that trigger excessive CPU consumption.
Affected Products
- Rack versions prior to 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1
- Debian Linux 10.0 (packaged Rack)
- Ruby web applications running on Ruby versions earlier than 3.2
Discovery Timeline
- 2024-02-29 - CVE-2024-26146 published to NVD
- 2025-02-14 - Last updated in NVD database
Technical Details for CVE-2024-26146
Vulnerability Analysis
The vulnerability is a Regular Expression Denial of Service (ReDoS) condition in Rack's HTTP header parsing logic. Rack uses regular expressions to tokenize and validate values in the Accept and Forwarded request headers. When the parser encounters specifically crafted input, the underlying regex engine backtracks excessively, producing pathological runtime behavior. The vulnerability affects availability only — confidentiality and integrity remain intact.
Because headers are processed early in the request lifecycle, every worker thread parsing a malicious request stalls until the regex completes. An attacker who sends a small number of crafted requests in parallel can exhaust available Ruby workers and prevent legitimate traffic from being served. The issue is tracked in GitHub Security Advisory GHSA-54rr-7fvw-6x8f.
Root Cause
The root cause is inefficient regular expression complexity [CWE-1333] in the routines that parse the Accept and Forwarded headers. The regex patterns contain ambiguous alternations that exhibit catastrophic backtracking on adversarial input. Ruby 3.2 introduced timeout-based regex execution limits that prevent worst-case runtime, which is why applications on that version are not affected.
Attack Vector
The attack is fully remote and requires no authentication or user interaction. An attacker submits HTTP requests containing maliciously constructed Accept or Forwarded header values to any endpoint served by a vulnerable Rack version. Each malicious request ties up a worker process for an extended period. Repeated requests amplify the impact into a sustained denial of service. Refer to the Rails Discussion on the DoS Vulnerability for additional context.
// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by crafted Accept and Forwarded
// header values that induce catastrophic regex backtracking
// during Rack request parsing. See GHSA-54rr-7fvw-6x8f for details.
Detection Methods for CVE-2024-26146
Indicators of Compromise
- HTTP requests containing unusually long, repetitive, or malformed Accept header values, especially with deeply nested quality parameters or repeated delimiters.
- HTTP requests with anomalous Forwarded header structures that do not conform to RFC 7239 syntax.
- Sustained spikes in Ruby worker CPU usage correlated with elevated request latency on Rack-based services.
- Application logs showing requests timing out during the middleware stage before reaching controller code.
Detection Strategies
- Inspect web server and application logs for slow request processing tied to specific source addresses sending atypical header payloads.
- Deploy a web application firewall (WAF) rule that flags Accept and Forwarded headers exceeding reasonable length thresholds or containing unusual character distributions.
- Compare installed Rack gem versions across the fleet using software composition analysis to identify hosts running pre-patch releases.
Monitoring Recommendations
- Track per-request processing time and alert on outliers that correlate with elevated worker CPU.
- Monitor the rate of HTTP 408, 502, and 504 responses, which can indicate worker exhaustion.
- Inventory Ruby runtime versions and Rack gem versions across all production services to prioritize remediation.
How to Mitigate CVE-2024-26146
Immediate Actions Required
- Upgrade Rack to 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1, or later, matching your current major version.
- Where feasible, upgrade the Ruby interpreter to 3.2 or newer, which mitigates the regex backtracking class of issues at the language level.
- Apply Debian security updates for affected debian_linux 10.0 packages as announced in the Debian LTS Announcement.
- Review the NetApp Security Advisory NTAP-20240510-0006 if running affected NetApp products that bundle Rack.
Patch Information
The Rack maintainers fixed the issue in versions 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. Relevant upstream commits include 30b8e39, 6c5d90b, a227cd7, and e4c1177. See the RubySec Advisory for the canonical advisory metadata.
Workarounds
- Enforce strict header length limits at a reverse proxy or WAF tier to drop requests with oversized Accept or Forwarded headers before they reach the Ruby application.
- Set per-request timeouts at the application server (Puma, Unicorn, Passenger) so worker processes cannot stall indefinitely on a single malicious request.
- Rate-limit unauthenticated traffic by source IP to reduce the effectiveness of repeated DoS attempts.
# Example: pin a patched Rack version in your Gemfile
# Choose the line matching your current major series
gem 'rack', '~> 2.2.8.1'
# gem 'rack', '~> 3.0.9.1'
# Then update and verify
bundle update rack
bundle list | grep rack
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
