Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | May 31, 2024 | Feb 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pcsUpgrade pcs-snmpUpgrade pcs-debuginfo | Mar 19, 2024 | Feb 29, 2024 |
| Debian | — | Upgrade ruby-rack | Apr 30, 2024 | Feb 29, 2024 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | May 7, 2024 | Feb 22, 2024 |
| Redhat_linux | — | Upgrade pcs-snmpNo solution existsUpgrade pcs | Apr 17, 2024 | Feb 29, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade pcs-snmp | Jun 17, 2024 | Feb 29, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.1-rubygem-rack-1_4Upgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack | Mar 6, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 13, 2024 | Feb 29, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub