https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:07:47 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:2113 <p><strong>Affected:</strong> AlmaLinux:9: pcs, AlmaLinux:9: pcs-snmp</p> <p>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.</p> <p>Security Fix(es):</p> <p>* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: pcs, AlmaLinux:9: pcs-snmp</p> <p>The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.</p> <p>Security Fix(es):</p> <p>* rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126) * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141) * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:2113 https://cve.radiocsirt.org/vuln/bdu:2024-01714 bdu:2024-01714 https://cve.radiocsirt.org/vuln/bdu:2024-01714 https://cve.radiocsirt.org/vuln/brew-mailcatcher-cve-2024-26141 <p><strong>Affected:</strong> Homebrew: mailcatcher</p> <p># Possible DoS Vulnerability with Range Header in Rack</p> <p>There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.</p> <p>Versions Affected: &gt;= 1.3.0. Not affected: &lt; 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1</p> <p>Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.</p> <p>Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications).</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- There are no feasible workarounds for this issue.</p> <p>Patches ------- To aid users who aren&#39;t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>* 3-0-range.patch - Patch for 3.0 series * 2-2-range.patch - Patch for 2.2 series</p> <p>Credits -------</p> <p>Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and patch</p> <p><strong>Affected:</strong> Homebrew: mailcatcher</p> <p># Possible DoS Vulnerability with Range Header in Rack</p> <p>There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.</p> <p>Versions Affected: &gt;= 1.3.0. Not affected: &lt; 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1</p> <p>Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.</p> <p>Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications).</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- There are no feasible workarounds for this issue.</p> <p>Patches ------- To aid users who aren&#39;t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>* 3-0-range.patch - Patch for 3.0 series * 2-2-range.patch - Patch for 2.2 series</p> <p>Credits -------</p> <p>Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and patch</p> https://cve.radiocsirt.org/vuln/brew-mailcatcher-cve-2024-26141 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0160 certfr-2024-avi-0160 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0160 https://cve.radiocsirt.org/vuln/euvd-2026-217283 EUVD-2026-217283 https://cve.radiocsirt.org/vuln/euvd-2026-217283 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26141 <p>Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.</p> <p>Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-26141 https://cve.radiocsirt.org/vuln/ghsa-xj5v-6v4g-jfw6 <p><strong>Affected:</strong> RubyGems: rack</p> <p># Possible DoS Vulnerability with Range Header in Rack</p> <p>There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.</p> <p>Versions Affected: &gt;= 1.3.0. Not affected: &lt; 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1</p> <p>Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.</p> <p>Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications).</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- There are no feasible workarounds for this issue.</p> <p>Patches ------- To aid users who aren&#39;t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>* 3-0-range.patch - Patch for 3.0 series * 2-2-range.patch - Patch for 2.2 series</p> <p>Credits -------</p> <p>Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and patch</p> <p><strong>Affected:</strong> RubyGems: rack</p> <p># Possible DoS Vulnerability with Range Header in Rack</p> <p>There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.</p> <p>Versions Affected: &gt;= 1.3.0. Not affected: &lt; 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1</p> <p>Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.</p> <p>Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications).</p> <p>Releases -------- The fixed releases are available at the normal locations.</p> <p>Workarounds ----------- There are no feasible workarounds for this issue.</p> <p>Patches ------- To aid users who aren&#39;t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.</p> <p>* 3-0-range.patch - Patch for 3.0 series * 2-2-range.patch - Patch for 2.2 series</p> <p>Credits -------</p> <p>Thank you [ooooooo_q](https://hackerone.com/ooooooo_q) for the report and patch</p> https://cve.radiocsirt.org/vuln/ghsa-xj5v-6v4g-jfw6 https://cve.radiocsirt.org/vuln/gsd-2024-26141 gsd-2024-26141 https://cve.radiocsirt.org/vuln/gsd-2024-26141 https://cve.radiocsirt.org/vuln/oesa-2024-1820 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: rubygem-rack</p> <p>Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572) Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: rubygem-rack</p> <p>Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Security Fix(es): A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572) Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1820 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13726-1 <p>ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media</p> <p>ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13726-1 https://cve.radiocsirt.org/vuln/rhsa-2024:10806 <p>python-ecdsa: vulnerable to the Minerva attack rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing rubygem-rack: Possible DoS Vulnerability with Range Header in Rack rubygem-activestorage: Possible Sensitive Session Information Leak in Active Storage rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing</p> <p>python-ecdsa: vulnerable to the Minerva attack rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing rubygem-rack: Possible DoS Vulnerability with Range Header in Rack rubygem-activestorage: Possible Sensitive Session Information Leak in Active Storage rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10806 https://cve.radiocsirt.org/vuln/suse-su-2024:0765-1 <p>Security update for rubygem-rack</p> <p>Security update for rubygem-rack</p> https://cve.radiocsirt.org/vuln/suse-su-2024:0765-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26141 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack</p> <p>Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack</p> <p>Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26141 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0911 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcs) ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pcs) ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0911