Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | May 31, 2024 | Feb 29, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pcs-snmpUpgrade pcsUpgrade pcs-debuginfo | Mar 19, 2024 | Feb 29, 2024 |
| Debian | — | Upgrade ruby-rack | Apr 30, 2024 | Feb 29, 2024 |
| Oracle_linux | — | Upgrade pcsUpgrade pcs-snmp | May 7, 2024 | Feb 22, 2024 |
| Redhat_linux | — | Upgrade pcsNo solution existsUpgrade pcs-snmp | Apr 17, 2024 | Feb 29, 2024 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade pcs | Jun 17, 2024 | Feb 29, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.1-rubygem-rack-1_4Upgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rack | Mar 6, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade ruby-rack (Ubuntu Pro)Upgrade ruby-rack | Mar 13, 2024 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub