https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:29:24.515796+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:2113 ALSA-2024:2113 — Moderate: pcs security update 2026-10-03T18:29:24.727366+00:00

Affected: AlmaLinux:9: pcs, AlmaLinux:9: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-01716 bdu:2024-01716 2026-10-03T18:29:24.727434+00:00 bdu:2024-01716 https://cve.radiocsirt.org/vuln/brew-mailcatcher-cve-2024-26146 BREW-mailcatcher-CVE-2024-26146 — Rack Header Parsing leads to Possible Denial of Service Vulnerability 2026-10-03T18:29:24.727451+00:00

Affected: Homebrew: mailcatcher

# Possible Denial of Service Vulnerability in Rack Header Parsing

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

Impact ------ Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- There are no feasible workarounds for this issue.

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 2-0-header-redos.patch - Patch for 2.0 series * 2-1-header-redos.patch - Patch for 2.1 series * 2-2-header-redos.patch - Patch for 2.2 series * 3-0-header-redos.patch - Patch for 3.0 series

Credits -------

Thanks to [svalkanov](https://hackerone.com/svalkanov) for reporting this and providing patches!

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0160 certfr-2024-avi-0160 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer un dén… 2026-10-03T18:29:24.727487+00:00 certfr-2024-avi-0160 https://cve.radiocsirt.org/vuln/euvd-2026-217287 EUVD-2026-217287 2026-10-03T18:29:24.727503+00:00 EUVD-2026-217287 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26146 fkie_cve-2024-26146 2026-10-03T18:29:24.727514+00:00

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

 https://cve.radiocsirt.org/vuln/ghsa-54rr-7fvw-6x8f GHSA-54rr-7fvw-6x8f — Rack Header Parsing leads to Possible Denial of Service Vulnerability 2026-10-03T18:29:24.727537+00:00

Affected: RubyGems: rack

# Possible Denial of Service Vulnerability in Rack Header Parsing

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

Impact ------ Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- There are no feasible workarounds for this issue.

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 2-0-header-redos.patch - Patch for 2.0 series * 2-1-header-redos.patch - Patch for 2.1 series * 2-2-header-redos.patch - Patch for 2.2 series * 3-0-header-redos.patch - Patch for 3.0 series

Credits -------

Thanks to [svalkanov](https://hackerone.com/svalkanov) for reporting this and providing patches!

 https://cve.radiocsirt.org/vuln/gsd-2024-26146 gsd-2024-26146 2026-10-03T18:29:24.727572+00:00 gsd-2024-26146 https://cve.radiocsirt.org/vuln/oesa-2025-1684 OESA-2025-1684 — rubygem-rack security update 2026-10-03T18:29:24.727584+00:00

Affected: openEuler:20.03-LTS-SP4: rubygem-rack

Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es):

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.(CVE-2024-26146)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13726-1 openSUSE-SU-2024:13726-1 — ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media 2026-10-03T18:29:24.727607+00:00

ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2024:10806 RHSA-2024:10806 — Red Hat Security Advisory: Satellite 6.15.5 Async Update 2026-10-03T18:29:24.727629+00:00

python-ecdsa: vulnerable to the Minerva attack rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing rubygem-rack: Possible DoS Vulnerability with Range Header in Rack rubygem-activestorage: Possible Sensitive Session Information Leak in Active Storage rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing

 https://cve.radiocsirt.org/vuln/suse-su-2024:0765-1 SUSE-SU-2024:0765-1 — Security update for rubygem-rack 2026-10-03T18:29:24.727651+00:00

Security update for rubygem-rack

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26146 UBUNTU-CVE-2024-26146 2026-10-03T18:29:24.727666+00:00

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0911 WID-SEC-W-2024-0911 — Red Hat Enterprise Linux (pcs): Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-03T18:29:24.727692+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcs) ausnutzen, um einen Denial of Service Angriff durchzuführen.