Executive brief
Rack is a widely used interface for Ruby web applications that handles communication between web servers and application code. A vulnerability in how it processes file download requests allows an attacker to send a specially crafted header that forces the server to perform excessive work. This can lead to a denial-of-service (DoS) condition, making the web application slow or completely unresponsive to legitimate users.
Technical details
The vulnerability exists in Rack::Utils.get_byte_ranges, which parses the HTTP Range header without limiting the total number of individual byte ranges requested. While a previous fix (CVE-2024-26141) restricted the total byte coverage, it did not limit the count of ranges. An unauthenticated remote attacker can provide a large number of small, overlapping ranges (e.g., '0-0,0-0,0-0...') to trigger disproportionate CPU, memory, and I/O consumption during multipart response generation. This results in a denial-of-service condition in file-serving paths. The issue is patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected products
- Rack Rack < 2.2.23, >= 3.0.0.beta1, < 3.1.21, >= 3.2.0, < 3.2.6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: NVD publication date